I am familiar with using various methods to generate a secure URL based on context, ie:

$this->getUrl('my-page', array('_forced_secure' => $this->getRequest()->isSecure()));

This works great for building links that will direct to a secure page while you are in secure mode (or will just link to the non-secure page if not using secure mode).

The problem I am looking at is Magento only treats a few special pages as needing to be secure (customer account, checkout, etc). What I would prefer would be to have Magento always use a secure link if the user is currently in secure mode, or use the non-secure link if the user is in non-secure mode.

From what I can tell, my only real options are:

  1. Modify every instance of $this->getUrl() to be similar to the snippet above.
  2. Set non-secure base_url to use HTTPS, forcing all pages to secure.

Is there a better method that won't involve having to change every call to $this->getUrl() or forcing all pages to HTTPS regardless of user's context?

-- edit --

I am aware I can modify /app/code/core/Mage/Core/Model/Url.php->setRouteParams() method, though I am hoping there is a cleaner way.


Having Magento always match the protocol which the user is currently on would cause problems, such as not spitting out secure URLs to the customer login page when on a non-secured URL like the home page of the site.

What I would suggest doing is adding some configuration XML to a custom module's config file to declare the additional routes you need to be secure as secure. You do this by having this in your config.xml file (replacing module_or_route_id with something unique:


If you take a peek at the config.xml for the Mage_Customer module you'll see an example of this where the path "/customer/" has been defined as secure.

Note: if the module_or_route_id portion of the above example is not unique, only one definition will be used, leading so something not being properly secured. Make sure that node name is unique. :)

Because this is path based though, I'm not certain how this would directly apply to URLs of individual CMS content pages, for example, as they will all still share a route/path since it's a rewrite which sends them all to the same CMS controller.

If you really need then entire site to run HTTPS, then you'll have to use https:// URLs for both secure and non-secure base URL settings.

  • I would prefer to just modify the core URL model rather than include additonal secure routes for every possible frontend route (especially the 'non-visible' routes such as catalogsearch/ajax/suggest, etc). Yes it's a core change, but it's an additional three lines of code vs. however many it would take to cover all frontend routes. In a situation where it's just a couple of routes you'd want to change, your suggestion makes a lot more sense. – pspahn Sep 27 '13 at 14:08
  • In the past we have modified Mage_Core_Model_Store::getBaseUrl to make our store always secure when embedded in a Facebook tab. There are other things to consider though, such as block cache storing whichever hit's it first (you'll have to add something to the cache key). You'll also either have as David says, non-secure links to login/checkout, or ultimately every customer to your site well end up in secure mode if they ever log in or hit the checkout. – Peter O'Callaghan Sep 27 '13 at 14:46
  • 1
    @pspahn Have you considered that setting the /catalogsearch/ path as secure should include anything matching /catalogsearch/*/*/? I.e. it would take only one rule to make everything under catalogsearch be secure. – davidalger Sep 27 '13 at 15:01
  • @Cags pointed out something I missed including in my answer, and that is the note about cache keys… if the URLs aren't consistently one or the other, you'll have cached blocks messing up the resulting links. – davidalger Sep 27 '13 at 15:03
  • That's a good point about cache keys. Seems like the best way to go would be to just run everything HTTPS. – pspahn Sep 27 '13 at 16:11

Set the following in your app/etc/config.xml file:

<?xml version="1.0"?>

This works in Magento 1.9.1

If user is using https, this should force all urls to rewrite to https.

  • Even better: Don't use config.xml but local.xml – Michael Mar 3 '16 at 12:24

THere's an understated but important option in System | Configuration | Web ~ where you have to say "use secure url in frontend" -- if you set this to yes then a page loaded by https will use https links,

no need to write code or provide additional configuration in most cases

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.