I've installed my SSL cert and everything is wrong starting with "The page at 'XXX' was loaded over HTTPS, but ran insecure content from 'YYY': this content should also be loaded over HTTPS."

and then: "XMLHttpRequest cannot load XXX. The request was redirected to 'YYY', which is disallowed for cross-origin requests that require preflight."

Can anyone help me please?

1 Answer 1


There is a recent post here: Magento: Allowing insecure content on https pages that details the two issues you're facing.

The most likely cause here is that you're loading elements with hardcoded HTTP urls. This could be part of your template, or plugins that are installed.

First thing to check would be that your configuration is set up correctly. System | Configuration | Web | Secure. Ensure you've configured to use SSL and your assets are loaded from {{secure_base_url}}

The next step is to figure out which assets are being loaded over a non-SSL connection and combat each one in turn.

The second issue is that you're loading AJAX results from another domain, which is not allowed due to the JS same-origin policy. You should refactor the external service if you have access to JSONP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.