The frontend is set to https entirely without problems. We did the following with no luck for the admin panel:

For both backend and frontend we set the secure and unsecure base urls to https://domain.com (where domain.com is substituted by our real domain ;)

We selected use secure urls in frontend and backend.

We set SSL_OFFLOADED as the Offloader header.

We set the .htaccess rules after RewriteEngine On.

RewriteCond %{HTTPS} off 
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

With this configuration the frontend loads perfectly in https, the backend in the other hand loads without styles also known as mixed content error. We looked around and came across a hack for this error that is put the following meta tag in the head tag of our admin site:

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

With this meta tag the site loads but now all the ajax calls are unresponsive, they can't work because all urls although converted to https with the .htaccess rule and the magento rules are rendered as http.

The rest of the backend functions but not the ajax calls. For example if I choose to open catalog/categories the page doesn't load and redirects to the admin homepage which in my case is orders. If i try to make any changes to any grids that uses ajax in somehow, they dont work also.

What should we do??

Any help is appreciated.

Thanks in advance

  • At first you can deactivate the ssl for the backend. brainsins.com/en/blog/… There you can see under Use Secure URLs in Admin Change to No.
    – Marcel
    Jul 18, 2018 at 12:27
  • Is the problem that the links for the "style" are not found?
    – Marcel
    Jul 18, 2018 at 12:31
  • The links to the assets all exist, but are generated using http.
    – rush4u
    Jul 18, 2018 at 15:52
  • If i deactivate ssl for the backend then the frontend looses ssl, it opens the first time with ssl but inside the site all urls are generated using http
    – rush4u
    Jul 18, 2018 at 15:53

1 Answer 1


In past I thought I had a similar problem. Can you try this in your htaccess:

RewriteEngine on
RewriteCond %{http_host} !^www\.your-domain\.com [NC]
Rewriterule ^(.*)$ https://www.your-domain.com/$1 [L,R=301]

Before I had the right one. I've testet many times.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.