Our Magento store is loading on https, not only on the checkout as we wanted. I set unsecure to http://www.yourdomain.com/ and secure to https://www.yourdomain.com/

Also set the use secure URL's on frontend to yes.

.htaccess does not contain any rewrite rule, we use the default Magento .htaccess.

Does anyone know where this rewrite rule is taking place?

  • Have you set them to http:// and https:// or http://www.yourdomain.com/ and https://www.yourdomain.com/? Have you looked what is in the database? Have you deleted cache, cookies, sessions, disabled compiler and tried other browsers?
    – MatthijsIJ
    Dec 27, 2014 at 13:12
  • No I did indeed set it to: yourdomain.com and yourdomain.com. Database contains the same data. Deleted all cache cookies, sessies etc. Can it be set in some Magento file?
    – JGeer
    Dec 27, 2014 at 13:14
  • This could also be caused by an extension. Sometimes <secure_url> is used in extensions config.xml files to force the extension to use a secure connection. Have you tried disabling all extensions?
    – MatthijsIJ
    Dec 27, 2014 at 13:22
  • Did you check all configuration scopes or just default? Dec 27, 2014 at 14:52
  • You can check app/code/core/Mage/Core/Model/Url.php -> public function getSecure. Also you can search in files for secure_is_forced. And also you can view phpinfo() through http:// and check if is set $_SERVER['HTTPS'] (it shouldn't be) and to check what is the value for $_SERVER['SERVER_PORT'] (it should be 80, not 443).
    – michael
    Dec 27, 2014 at 15:48

3 Answers 3


Use Secure URLs in FrontendPlease check in your magento admin System -> Configuration -> General -> Web for "Use Secure URLs in Frontend". If it is yes then revert to no and https will not be used as default and it it will work only on checkout pages


Navigate to the following in your admin control panel

System-> Config -> Web -> Unsecure

Most likely you have it set to https://www.domain.com/ it should be http://www.domain.com/


Debug steps:

  1. As Brent says and verify the correct configuration scope.
  2. You haven't cleared your configuration and block_html cache since the change of 1).
  3. Redirect to base URL is set to "off". You or your predecessor have implemented Strict Transport Security. In this case everything in Magento is configured correctly, but your browser silently rewrites locally to https and requests it as such.

Pretty much what I've seen in the wild.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.