When I open the site using https://mydomain.com all layout (front/backend) is "broken" and appears inconsistent:

  • The headers contains all js/css but they are loaded with http:// protocol and the css rules are not applied

My problem looks exactly like this: https://demo.magentocommerce.com/

I have tested on my local installation ( same DB/CODE ) and it is working fine.

EDIT 2 After some investigation we found out that our FastCGI/Sbox is not setting HTTPS server variable when needed and that cause the wrong behavior on Magento

  • check your secure url settings. Feb 21, 2013 at 13:50
  • those are ok https://mydomain.com
    – Fra
    Feb 21, 2013 at 13:52
  • 2
    Maybe you have the setting on a level lower (website, store) where the setting is different? Or there is caching going on?
    – mpaepper
    Feb 21, 2013 at 14:01
  • Really this is not the issue, I'm quite sure it is server config related problem
    – Fra
    Feb 21, 2013 at 14:06
  • @Francesco make sure that you have a trailing slash in those fields
    – philwinkle
    Feb 21, 2013 at 14:25

2 Answers 2


Your browser is probably blocking un-secure content

Some versions of recent browsers (FireFox/Chrome) will reject HTTP content when the page is served over HTTPS. This is to prevent insecure content being served alongside secure content.

So if you visit the homepage in Magento and specify https:// in the URL, all the linked resources within the page source will still be http:// - and the browser may reject loading that content to preserve security.

But if you've loaded the page once before, there's a good chance that some CSS/JS/Images may well already be in the browser cache, mitigating the requirement to fetch the resource remotely.

This can give the impression that it works on some machines and not on others. Where in reality - its not really working for anyone, its just that some users benefit from their historical browser cache.

Self-signed certificates can also produce this exact behaviour.

Magento won't use HTTPS on the Homepage by default

Magento doesn't want/need to serve content over https:// unless either

  1. The page warrants HTTPS (customer account, checkout etc.)
  2. You changed the unsecure base url to be HTTPS regardless

Under normal situations, there simply isn't a requirement for the homepage to be served over HTTPS - and if your unsecure base url is just http:// - then Magento will still continue to load un-secure resources.

So if you want HTTPS on your homepage, either change core code to dictate whether the area needs to be secure or not - or make the entire site HTTPS regardless.

Its normal, don't worry

Basically, what you are seeing is normal behaviour - on the front-end at least. Just because you want HTTPS on the homepage, doesn't mean Magento will serve everything to you with HTTPS.

Its more concerning what is happening with your back-end, but again, if you haven't actually enabled "Use Secure URLs in Admin" and defined a https:// URL for the "Base Secure URL" - then again, what you see is normal.

If you want HTTPS, ensure you enable in the front-end/back-end as appropriate and set the "Base Secure URL" to suit.

  • I think the issue is related to Fastcgi/sbox: I have checked and it doens't set the variable Server variable HTTPS.
    – Fra
    Feb 22, 2013 at 16:29
  • What I'm experiencing it is not the default magento behavior: as I wrote in the question it works well on my local installation
    – Fra
    Feb 22, 2013 at 16:30
  • Unless you have set ALL your URLs to be HTTPS - Magento will NOT serve HTTPS content on the homepage. And your browser will potentially block that content. Take our own website as an example, sonassihosting.com - forcing HTTPS breaks the CSS and JS rendering in FireFox. Feb 22, 2013 at 17:52
  • this just a test to debug the issue: that is why I'm opening the url direclty on https://. On local it work on live not, the reason is the above comment
    – Fra
    Feb 22, 2013 at 17:58
  • But you cannot test it with the homepage. Test a resource that actually should be HTTPS, checkout/customer login etc. Not the homepage, *unlesss you've changed the unsecure base URL to be https:// Feb 26, 2013 at 17:11

The issue was generated by the server environment, it did not set [HTTPS] variable in the right way.

Adding this line in index.php restored the expected behavior

if (isset($_SERVER['SERVER_PORT']) && (443 == $_SERVER['SERVER_PORT'])) $_SERVER['HTTPS'] = 'on';
  • 3
    See this article - you could do that more elegantly in your .htaccess. By using SetEnvIf SERVER_PORT 443 HTTPS=on Feb 28, 2013 at 15:36
  • you are right, however 'SetEnv' and 'SetEnvIF' doesn't work on some CGI Env.
    – Fra
    Mar 1, 2013 at 9:25
  • 1
    Then set the fastcgi_param accordingly then. Eg. for Nginx fastcgi_param HTTPS $https if_not_empty; Mar 1, 2013 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.