<p>It's probable that your Site URL in your website's config is using <code>http</code> rather than <code>https</code>. Setting it to <code>https</code> should force the control panel assets to load appropriately.</p>

<p>You can change this in Craft's <code>Settings &gt; System  &gt; General</code> screen.</p>

<p>If you've overriden this in your website's config setting you'll instead need to update the <code>siteUrl</code> setting in that file. Documentation for this can be <a href="http://craftcms.com/docs/config-settings#siteUrl" rel="nofollow noreferrer">found here</a>.</p>

CC BY-SA 3.0
2017-03-11T15:19:28.963Z
2017-03-11T15:19:28.963Z
Mutual
<p>Craft's default setting is <code>'resourceBaseUrl' =&gt; '@web/cpresources'</code>. If your site or Docker Container runs http, Craft seems to (correctly) determine the http setup. This is why it ignores your <code>siteUrl</code> / <code>ROOT_SITE_URL</code>.</p>

<p><strong>To fix this, either overwrite <code>@web</code> or manually set <code>'resourceBaseUrl'</code>.</strong></p>

<hr>

<h2>Set resourceBaseUrl</h2>

<p>Explictly set <code>'resourceBaseUrl' =&gt; getenv('ROOT_SITE_URL')</code> in config/general.php (assuming you ROOT_SITE_URL / siteUrl is set to something <a href="https://.." rel="nofollow noreferrer">https://..</a>.)</p>

<hr>

<h2>Overwrite @web</h2>

<p>Overwrite <code>@web</code> in <code>config/general.php</code>:</p>

<pre><code>// Aliases for use in CP
'aliases' =&gt; [
    '@web' =&gt; getenv('ROOT_SITE_URL'),
]
</code></pre>

CC BY-SA 4.0
2020-03-26T18:45:49.103Z
2020-03-26T20:15:39.533Z
2020-03-26T20:15:39.533Z
Max Strebel
<p>The solution I came to was creating an Origin Certificate on Cloudflare, installing on it on my VPS, and setting the SSL setting to Full Strict. Now admin assets are loading perfectly over https. No .htaccess or Patrol plugin required.</p>

<p>If someone knows more about why this worked and the previous approach didn't I would love to hear your thoughts. Thanks @MattStein for clueing me towards this approach.</p>

CC BY-SA 4.0
2018-06-27T05:09:05.503Z
Noting that this is also relevant for Craft 3
lealea
CC BY-SA 3.0
2017-03-13T20:56:06.597Z
2017-03-13T20:56:06.597Z
Rjoss
<p>staging.website.com loads perfectly over https. However, https admin pages immediately break because the assets are trying to load over http. If I navigate to the https asset directly, it loads fine. It would seem that Craft is failing to recognize the https request and kick over to the https url.</p>

<p>Server Setup:</p>

<ul>
<li>Cloudflare DNS / SSL</li>
<li>Arcustech VPS with Ubuntu &amp; Apache</li>
</ul>

<p>How I am enforcing HTTPS currently:</p>

<ul>
<li>Cloudflare Page Rule (Always Use HTTPS)</li>
<li>Craft config: general.php > environmentVariables (siteUrl, baseCpUrl, etc.)</li>
</ul>

<p>I do not have any https redirects going in my .htaccess - just the standard craft index.php logic. Adding https rules in the .htaccess will cause infinite loop redirects.</p>

CC BY-SA 3.0
2017-03-10T19:55:46.833Z
The type of Cloudflare SSL (full, flexible) matters, and a common problem is that Cloudflare offers https by querying your server at _http_ URLs and sprucing them up. Your server is likely responding admirably, but may need encouragement to serve https URLs in this situation: https://gist.github.com/joshuabaker/bb45340bc4eda4c7d932
Matt Stein
CC BY-SA 3.0
2017-03-10T20:27:55.703Z
Thanks for the quick reply. So if I went the "SSL full" route, do you think I would completely sidestep the issue I'm having here?

I tried that Gist and its still reporting back http in the admin.
Rjoss
CC BY-SA 3.0
2017-03-10T21:58:18.727Z
Probably not, and I honestly forget but assume Cloudflare's going to send the same headers (hints about SSL) either way. It might help to post your Craft config and detail your Cloudflare setup. You might also consider the [Patrol plugin](https://selvinortiz.com/work/craft/patrol) if you haven't already and just want to get on with your https control paneling.
Matt Stein
CC BY-SA 3.0
2017-03-10T22:49:05.423Z
[general.php config](https://gist.github.com/Rjoss/1d21081ae15ee6cb19861e9b9bd90059), [Cloudflare DNS](https://cl.ly/253k270O1J3a), [Cloudflare Page Rules](https://cl.ly/1k00011j0H1k)
Rjoss
CC BY-SA 3.0
2017-03-10T23:06:03.057Z
I gave that Patrol plugin a shot - it definitely enforces https across the site. However, it seems to have no effect on the admin assets. In particular, Craft's admin css is trying to load a http font file: @font-face { font-family: 'Craft'; src: url("http://staging.website.com/admin/resources/fonts/Craft.eot?x=N99U2mbA3");
Rjoss
CC BY-SA 3.0
2017-03-11T00:28:50.000Z
And you've fully cleared Craft's and Cloudflare's caches as you've made configuration updates? Something seems fishy. Might also be better to move this to the Slack #help channel.
Matt Stein
<apache><https><cloudflare>
Craft Admin assets do not load over https (Apache & Cloudflare)
# Craft Admin assets do not load over https (Apache & Cloudflare)

(Asked by: username_0 on 2017-03-10)

staging.website.com loads perfectly over https. However, https admin pages immediately break because the assets are trying to load over http. If I navigate to the https asset directly, it loads fine. It would seem that Craft is failing to recognize the https request and kick over to the https url.

Server Setup:

* Cloudflare DNS / SSL
* Arcustech VPS with Ubuntu & Apache

How I am enforcing HTTPS currently:

* Cloudflare Page Rule (Always Use HTTPS)
* Craft config: general.php > environmentVariables (siteUrl, baseCpUrl, etc.)

I do not have any https redirects going in my .htaccess - just the standard craft index.php logic. Adding https rules in the .htaccess will cause infinite loop redirects.

**Tags:** apache, https, cloudflare
> **Comments:**
> **username_1**: The type of Cloudflare SSL (full, flexible) matters, and a common problem is that Cloudflare offers https by querying your server at _http_ URLs and sprucing them up. Your server is likely responding admirably, but may need encouragement to serve https URLs in this situation: https://gist.github.com/joshuabaker/bb45340bc4eda4c7d932  
> **username_0**: Thanks for the quick reply. So if I went the "SSL full" route, do you think I would completely sidestep the issue I'm having here?  I tried that Gist and its still reporting back http in the admin.  
> **username_1**: Probably not, and I honestly forget but assume Cloudflare's going to send the same headers (hints about SSL) either way. It might help to post your Craft config and detail your Cloudflare setup. You might also consider the [Patrol plugin](https://selvinortiz.com/work/craft/patrol) if you haven't already and just want to get on with your https control paneling.  
> **username_0**: [general.php config](https://gist.github.com/Rjoss/1d21081ae15ee6cb19861e9b9bd90059), [Cloudflare DNS](https://cl.ly/253k270O1J3a), [Cloudflare Page Rules](https://cl.ly/1k00011j0H1k)  
> **username_0**: I gave that Patrol plugin a shot - it definitely enforces https across the site. However, it seems to have no effect on the admin assets. In particular, Craft's admin css is trying to load a http font file: @font-face { font-family: 'Craft'; src: url("http://staging.website.com/admin/resources/fonts/Craft.eot?x=N99U2mbA3");  
> **username_1**: And you've fully cleared Craft's and Cloudflare's caches as you've made configuration updates? Something seems fishy. Might also be better to move this to the Slack #help channel.  

---

## 3 answers

### Answer by username_0 on 2017-03-13. Score: 5 | Accepted answer

The solution I came to was creating an Origin Certificate on Cloudflare, installing on it on my VPS, and setting the SSL setting to Full Strict. Now admin assets are loading perfectly over https. No .htaccess or Patrol plugin required.

If someone knows more about why this worked and the previous approach didn't I would love to hear your thoughts. Thanks @MattStein for clueing me towards this approach.

> **Comments:**
> **username_4**: Noting that this is also relevant for Craft 3  

---

### Answer by username_2 on 2017-03-11. Score: 1

It's probable that your Site URL in your website's config is using `http` rather than `https`. Setting it to `https` should force the control panel assets to load appropriately.

You can change this in Craft's `Settings > System > General` screen.

If you've overriden this in your website's config setting you'll instead need to update the `siteUrl` setting in that file. Documentation for this can be [found here](http://craftcms.com/docs/config-settings#siteUrl).


---

### Answer by username_3 on 2020-03-26. Score: 1

Craft's default setting is 'resourceBaseUrl' => '@web/cpresources'. If your site or Docker Container runs http, Craft seems to (correctly) determine the http setup. This is why it ignores your siteUrl / ROOT_SITE_URL.
To fix this, either overwrite @web or manually set 'resourceBaseUrl'.

Set resourceBaseUrl
Explictly set 'resourceBaseUrl' => getenv('ROOT_SITE_URL') in config/general.php (assuming you ROOT_SITE_URL / siteUrl is set to something https://...)

Overwrite @web
Overwrite @web in config/general.php:
// Aliases for use in CP
'aliases' => [
    '@web' => getenv('ROOT_SITE_URL'),
]


---

