I'm having an issue where I insert an image into a static block using the WYSIWYG editor. This results in an image tag like this:

<img src="{{media url="image.jpg"}}" />

The problem is that with block caching enabled the block doesn't get cached individually for SSL and non-SSL pages. I.e. if I visit a non-SSL page first and visit the same page again with SSL enabled the src attribute will contain a non-SSL link resulting in the respective warnings (and no green padlock).

This works perfectly fine when the block caching is disabled.

I dug into this and discovered that Magento doesn't seem to generate separate cache ids for SSL and non-SSL requests. I did the following change:

--- app/code/core/Mage/Cms/Block/Block.php      2016-10-12 13:55:55.823302409 -1000
+++ app/code/local/Mage/Cms/Block/Block.php     2016-10-13 08:39:48.307225894 -1000
@@ -86,6 +86,7 @@
+                (int)Mage::app()->getStore()->isCurrentlySecure(),
         } else {
             $result = parent::getCacheKeyInfo();

That fixes the problem. I don't think that this is the correct solution though as this would mean that SSL would be broken for all existing Magento installs (checked 1.9.3 code). Does anybody have an idea what I'm missing here?

Currently running fully patched.

  • I faced the same problem and I think this is the best solution. I guess that not a lot of people use mixed https/http environments. the problem still occurs in CE I will overwrite this CMS Block class Thanks Jun 22, 2017 at 9:42
  • Yeah, mixed SSL/non-SSL is not ideal anyways. At this point I just switched the entire site to SSL. Jun 23, 2017 at 23:24

2 Answers 2


I didn't end up finding a solution I'm happy with. I'm certain I'm missing something because otherwise mixed SSL and non-SSL environments wouldn't work.

I settled on this solution for now:

--- app/code/core/Mage/Core/Block/Abstract.php  2016-10-20 10:36:59.660834474 -1000
+++ app/code/local/Mage/Core/Block/Abstract.php 2016-10-25 07:12:23.238775078 -1000
@@ -1292,15 +1292,15 @@
     public function getCacheKey()
-        if ($this->hasData('cache_key')) {
-            $cacheKey = $this->getData('cache_key');
-            if (strpos($cacheKey, self::CACHE_KEY_PREFIX) !== 0) {
-                $cacheKey = self::CACHE_KEY_PREFIX . $cacheKey;
-                $this->setData('cache_key', $cacheKey);
-            }
+        $secure = $this->_isSecure() ? '_ssl' : '_non_ssl';

-            return $cacheKey;
+        if ($this->hasData('cache_key')) {
+            $key = $this->getData('cache_key');
+            if (strpos($key, self::CACHE_KEY_PREFIX) !== 0) {
+                $key = self::CACHE_KEY_PREFIX . $key;
+                $this->setData('cache_key', $key);
+        } else {
          * don't prevent recalculation by saving generated cache key
          * because of ability to render single block instance with different data
@@ -1310,7 +1310,9 @@
         $key = array_values($key); // ignore array keys
         $key = implode('|', $key);
         $key = sha1($key);
-        return $key;
+        }
+        return $key . $secure;


Of course this is far from optimal but I figured it might be helpful to someone.

  • Seems this bug is still present and there is no better solution for mixed environments. thanks for sharing. May 17, 2018 at 11:09


In most cases, some images or forms on the page are loaded over plain HTTP, without SSL. It can happen when CMS pages are edited by hand and some images or other resources pasted with absolute URL hardcoded with http:// protocol prefix instead of https:// or just //. In the worst cases, web-server configuration is incorrect or does not provide security level expected by browser

Find all non-SSL elements

Right click anywhere on your page, in context menu select View Source option. In source view page press ctrl+f and search for src="http:// or src='http:// or even src=http:// text:


Replace all non-SSL calls with protocol-relative or SSL call

For every non-SSL resource replace its non-SSL call (http://) with protocol-relative (//) or forced SSL call (https://). In example, replace http://example.com/image.jpg with //example.com/image.jpg or https://example.com/image.jpg.

If non-SSL calls are made by code, i.e. getBaseUrl function, add array('_secure'=>true) option, so

<?php echo Mage::getBaseUrl(Mage_Core_Model_Store::URL_TYPE_LINK); ?>

should be like the following after adding it:

<?php echo Mage::getBaseUrl(Mage_Core_Model_Store::URL_TYPE_LINK, array('_secure'=>true)); ?>

Flush caches to apply changes

  • The block names are unique, that shouldn't be the problem. The issue is that SSL and non-SSL generated blocks don't get cached individually. The solution I'm looking for shouldn't require a core code change. If that would be necessary SSL would be broken for all Magento installs without core changes. I'm certain that this is not the case. Oct 17, 2016 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.