<p>This <a href="https://github.com/craftcms/cms/issues/2622" rel="nofollow noreferrer">Github issue</a> helped me solve the problem and it was indeed tied to not forcing everything to SSL. Once I added the code below to my .htaccess to force all HTTP to HTTPs, it solved the problem:</p>

<pre><code>RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
</code></pre>

CC BY-SA 4.0
2018-11-27T21:24:39.223Z
2018-11-27T21:24:39.223Z
dpayne
<p>I followed <a href="https://medium.com/@madebyraygun/a-quick-and-easy-local-environment-for-craft-3-4fd7c7ff5815" rel="nofollow noreferrer">this guide</a> to move my local hosting from WAMP, which has been giving me a bunch of 500 errors since switching to Craft 3, to Local By Flywheel. After getting everything configured, I can access the site and everything seems to be working fine. The issue I'm having is I'm unable to access the control panel to make changes. The login screen keeps just redirecting back to the login screen after entering the credentials. </p>

<p>Here are the details I have as far as what's going on:</p>

<ul>
<li>I know the credentials I'm entering are correct. I get an error on the login page when I put in an incorrect password</li>
<li>I've checked the Craft logs and don't see any obvious warnings or error messages related to login</li>
<li>Removing everything in the Craft log folder doesn't change anything</li>
<li>I'm running Apache (2.4.1, I believe), PHP 7.0.3, and MySQL 5.5.6</li>
</ul>

<p>Here is the .htaccess we're using (I don't think it's the issue but I know it's a common one for this sort of stuff):</p>

<pre><code>&lt;IfModule mod_expires.c&gt;
 ExpiresActive on
 # Perhaps better to whitelist expires rules? Perhaps.
 ExpiresDefault "access plus 1 month"
 # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5)
 ExpiresByType text/cache-manifest "access plus 0 seconds"
 # Your document html
 ExpiresByType text/html "access plus 0 seconds"
 # Data
 ExpiresByType text/xml "access plus 0 seconds"
 ExpiresByType application/xml "access plus 0 seconds"
 ExpiresByType application/json "access plus 0 seconds"
 # Feed
 ExpiresByType application/rss+xml "access plus 1 hour"
 ExpiresByType application/atom+xml "access plus 1 hour"
 # Favicon (cannot be renamed)
 ExpiresByType image/x-icon "access plus 1 week"
 # Media: images, video, audio
 ExpiresByType image/gif "access plus 1 month"
 ExpiresByType image/png "access plus 1 month"
 ExpiresByType image/jpeg "access plus 1 month"
 ExpiresByType video/ogg "access plus 1 month"
 ExpiresByType audio/ogg "access plus 1 month"
 ExpiresByType video/mp4 "access plus 1 month"
 ExpiresByType video/webm "access plus 1 month"
 # Webfonts
 ExpiresByType application/x-font-ttf "access plus 1 month"
 ExpiresByType font/opentype "access plus 1 month"
 ExpiresByType application/x-font-woff "access plus 1 month"
 ExpiresByType image/svg+xml "access plus 1 month"
 ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
 ExpiresByType text/css "access plus 1 year"
 ExpiresByType application/javascript "access plus 1 year"
&lt;/IfModule&gt;

&lt;IfModule mod_deflate.c&gt;
 AddOutputFilterByType DEFLATE text/html text/plain text/css application/json
 AddOutputFilterByType DEFLATE application/javascript
 AddOutputFilterByType DEFLATE text/xml application/xml text/x-component
 AddOutputFilterByType DEFLATE application/xhtml+xml application/rss+xml application/atom+xml
 Addtype font/opentype .otf
 Addtype font/truetype .ttf
 AddOutputFilterByType DEFLATE image/x-icon image/svg+xml application/vnd.msfontobject application/x-font-ttf font/opentype font/truetype
&lt;/IfModule&gt;

&lt;IfModule mod_rewrite.c&gt;
     RewriteEngine On

    # remove version numbers used for cache busting.
    # maps site.min.1234.css to site.min.css
    # See https://nystudio107.com/blog/simple-static-asset-versioning
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^(.+)\.(\d+)\.(bmp|css|cur|gif|ico|jpe?g|js|png|svgz?|webp|webmanifest)$ $1.$3 [L]

    #301 redirect with trailing slash
        RewriteCond %{REQUEST_URI} /+[^\.]+$
        RewriteRule ^(.+[^/])$ %{REQUEST_URI}/ [R=301,L]

    #Send would-be 404 requests to Craft
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
        RewriteRule (.+) index.php?p=$1 [QSA,L]
  AddType text/x-component .htc

&lt;/IfModule&gt;
</code></pre>

<p>The only thing that seems a bit odd is on the login page, it keeps redirecting from the HTTPS version to the HTTP version upon form submission. Same login page, but after submission it goes from HTTPs to HTTP and then I can't get past then on subsequent attempts. The rest of the site works fine on HTTPs. Not sure if that could be tied to the issue or what's going on there but wanted to call that out as being of note.</p>

<control-panel><redirect><login><htaccess><https>
Can't Get Past Control Panel Login. Keeps Redirecting Back to Login Page
# Can't Get Past Control Panel Login. Keeps Redirecting Back to Login Page

(Asked by: username_0 on 2018-11-27)

I followed this guide to move my local hosting from WAMP, which has been giving me a bunch of 500 errors since switching to Craft 3, to Local By Flywheel. After getting everything configured, I can access the site and everything seems to be working fine. The issue I'm having is I'm unable to access the control panel to make changes. The login screen keeps just redirecting back to the login screen after entering the credentials. 
Here are the details I have as far as what's going on:

I know the credentials I'm entering are correct. I get an error on the login page when I put in an incorrect password
I've checked the Craft logs and don't see any obvious warnings or error messages related to login
Removing everything in the Craft log folder doesn't change anything
I'm running Apache (2.4.1, I believe), PHP 7.0.3, and MySQL 5.5.6

Here is the .htaccess we're using (I don't think it's the issue but I know it's a common one for this sort of stuff):

 ExpiresActive on
 # Perhaps better to whitelist expires rules? Perhaps.
 ExpiresDefault "access plus 1 month"
 # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5)
 ExpiresByType text/cache-manifest "access plus 0 seconds"
 # Your document html
 ExpiresByType text/html "access plus 0 seconds"
 # Data
 ExpiresByType text/xml "access plus 0 seconds"
 ExpiresByType application/xml "access plus 0 seconds"
 ExpiresByType application/json "access plus 0 seconds"
 # Feed
 ExpiresByType application/rss+xml "access plus 1 hour"
 ExpiresByType application/atom+xml "access plus 1 hour"
 # Favicon (cannot be renamed)
 ExpiresByType image/x-icon "access plus 1 week"
 # Media: images, video, audio
 ExpiresByType image/gif "access plus 1 month"
 ExpiresByType image/png "access plus 1 month"
 ExpiresByType image/jpeg "access plus 1 month"
 ExpiresByType video/ogg "access plus 1 month"
 ExpiresByType audio/ogg "access plus 1 month"
 ExpiresByType video/mp4 "access plus 1 month"
 ExpiresByType video/webm "access plus 1 month"
 # Webfonts
 ExpiresByType application/x-font-ttf "access plus 1 month"
 ExpiresByType font/opentype "access plus 1 month"
 ExpiresByType application/x-font-woff "access plus 1 month"
 ExpiresByType image/svg+xml "access plus 1 month"
 ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
 ExpiresByType text/css "access plus 1 year"
 ExpiresByType application/javascript "access plus 1 year"



 AddOutputFilterByType DEFLATE text/html text/plain text/css application/json
 AddOutputFilterByType DEFLATE application/javascript
 AddOutputFilterByType DEFLATE text/xml application/xml text/x-component
 AddOutputFilterByType DEFLATE application/xhtml+xml application/rss+xml application/atom+xml
 Addtype font/opentype .otf
 Addtype font/truetype .ttf
 AddOutputFilterByType DEFLATE image/x-icon image/svg+xml application/vnd.msfontobject application/x-font-ttf font/opentype font/truetype



     RewriteEngine On

    # remove version numbers used for cache busting.
    # maps site.min.1234.css to site.min.css
    # See https://nystudio107.com/blog/simple-static-asset-versioning
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^(.+)\.(\d+)\.(bmp|css|cur|gif|ico|jpe?g|js|png|svgz?|webp|webmanifest)$ $1.$3 [L]

    #301 redirect with trailing slash
        RewriteCond %{REQUEST_URI} /+[^\.]+$
        RewriteRule ^(.+[^/])$ %{REQUEST_URI}/ [R=301,L]

    #Send would-be 404 requests to Craft
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
        RewriteRule (.+) index.php?p=$1 [QSA,L]
  AddType text/x-component .htc



The only thing that seems a bit odd is on the login page, it keeps redirecting from the HTTPS version to the HTTP version upon form submission. Same login page, but after submission it goes from HTTPs to HTTP and then I can't get past then on subsequent attempts. The rest of the site works fine on HTTPs. Not sure if that could be tied to the issue or what's going on there but wanted to call that out as being of note.

**Tags:** control-panel, redirect, login, htaccess, https


---

## 1 answers

### Answer by username_0 on 2018-11-27. Score: 1 | Accepted answer

This Github issue helped me solve the problem and it was indeed tied to not forcing everything to SSL. Once I added the code below to my .htaccess to force all HTTP to HTTPs, it solved the problem:
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]


---

