WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Having a mixed security issue that is affecting functionality in browsers because some of my plugins are loading with http instead of https. I'm running under a multisite setup.


This is what I have in my htaccess

# BEGIN WordPress
RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

RewriteBase /
RewriteRule ^index\.php$ - [L]

# uploaded files
RewriteRule ^([_0-9a-zA-Z-]+/)?files/(.+) wp-includes/ms-files.php?file=$2 [L]

# add a trailing slash to /wp-admin
RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule  ^[_0-9a-zA-Z-]+/(wp-(content|admin|includes).*) $1 [L]
RewriteRule  ^[_0-9a-zA-Z-]+/(.*\.php)$ $1 [L]
RewriteRule . index.php [L]
# END WordPress
share|improve this question
up vote 2 down vote accepted

Most likely, what you mean is that some assets (images, JavaScript, etc.) rendered by your plugins are being served explicitly over http. (Please correct me if I've misunderstood).

These problems need to be fixed in each of the individual plugins, and the fixes will vary based on how the assets are referred to. There are lots of ways to refer to assets, and lots of ways to specify a protocol. (In general, if you use something like site_url() to generate links to assets, they'll automatically be assigned the correct protocol. But there are lots of WordPress functions that do this kind of thing.) You'll have to pop open the offending plugins and look.

The bad news is, no amount of rewriting with htaccess will fix this issue for you. Your browser makes this "mixed content" determination before actually requesting all the files. And though the requests may eventually be rewritten to https, your browser won't notice. The browser only cares about how assets are referred to in the page markup, and rewrite rules don't change markup at all--only the way in which the server reacts to specific requests.

You feel me?

share|improve this answer
Yep makes total sense. I went in and manually updated in the offending plugins. Maybe I should send those authors a note to say they should fix their stuff ;) – plumwd May 7 '12 at 20:00
@plumwd Yes, you should definitely tell them to fix their stuff! :) – MathSmath May 7 '12 at 22:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.