I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome allows me to browse to my domain via https).

I'm getting a bunch of error messages like this:

The page at https://example.com/ ran insecure content from http://www.example.com/sites/default/files/css/css_TsVRTbLFUpEZAfw-_bWPJu840QT523CPjUVJ5MRWfyk.css

There are about 20-30 of these errors - mostly .js and .css files, some .png etc. Questions:

  1. How can I configure d7 so that it accesses these files via relative paths

  2. Are there any other workarounds here, to enable https on my drupal install?

Much thanks in advance.


Somewhat ugly, but you can do something like this for Drupal 6

function mytheme_preprocess_page (&$vars)
  $vars['scripts'] = str_replace("http://www.example.com/", "/", $vars['scripts']);
  $vars['styles'] = str_replace("http://www.example.com/", "/", $vars['styles']);
  $vars['content'] = str_replace("http://www.example.com/", "/", $vars['content']);

or for Drupal 7

function mytheme_process_html (&$variables) {
  $variables['scripts'] = str_replace("http://www.example.com/", "/", $variables['scripts']);
  $variables['styles'] = str_replace("http://www.example.com/", "/", $variables['styles']);
  $variables['page'] = str_replace("http://www.example.com/", "/", $variables['page']);

You can be a bit smarter and use PREG, but have never run into the need. Note that there may be a few additional regions / variables that you need to do replacement on.

I normally put in something similar to handle hardcoded URLs from the WYSIWYG when migrating from a dev URL to a live one.

  • My $vars array doesn't contain the arrays you reference... – starsinmypockets Aug 30 '11 at 18:36
  • 1
    Sorry. Overlooked the that you are using Drupal 7. I updated my answer to show both Drupal 6 and Drupal 7 versions. – mpdonadio Aug 30 '11 at 19:43
  • Thanks so much - that's got me down to favicon.ico, that little bugger... – starsinmypockets Aug 30 '11 at 20:17
  • $variables['head'] – mpdonadio Aug 30 '11 at 20:33
  • @starsinmypockets: imho; think the below answer is more drupalish. – chrisjlee Apr 23 '12 at 19:03

Simply remove $base_url from your settings.php file; Drupal will detect $base_url automatically.

If you must set this value explicitly, you can add a little conditional logic to your settings file, such as:

if (isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on') {
  $base_url = 'https://example.com';
else {
  $base_url = 'http://example.com';
  • 1
    Removing $base_url and clearing the Drupal cache worked for me – Code Slinger Jan 29 '14 at 19:26
  • I had no $base_url set, but I hadn't cleared the cache since I turned on SSL. When I finally did, my image paths got regenerated so it worked. – colan Sep 10 '14 at 19:26

I had the same issue. In my case the pre-processing worked fine. However, when the requests were coming in from our Load Balancer, the pre-processing was not working. Strange.

Even so, found an easier solution. Add - $base_url = ''; to the settings.php

This way both http and https requests work fine. All css calls, etc. constructed by Drupal become relative and start with "/sites/..." instead of "http://servername/sites/..."

IMHO the default, if no base_url is specified should be relative URLs and not absolute. May be a fix in the next version of Drupal?

  • I tried this approach and it worked perfectly, but I get a notice message: Notice: Undefined offset: 1 in drupal_settings_initialize() (line 758 of /includes/bootstrap.inc) on php 5.5 and nginx – Sohail Oct 9 '13 at 11:06
  • try the answer I provided below – Sohail Oct 9 '13 at 11:21

In setting.php file of drupal 7/6 add the following:

else {
  • This was the issue for me, my Drupal 7 site was sitting behind Cloudflare and I turned on https. Drupal thought it was serving http content, so wouldn't load css and js with (blocked:mixed-content). – Cameron Apr 18 '18 at 23:35

If your website runs behind the reverse proxy (such as CloudFront), enable reverse_proxy setting.

Drupal 8

Apply the following settings in site's settings.php file:

$settings['reverse_proxy'] = TRUE;
$settings['reverse_proxy_addresses'] = [@$_SERVER['REMOTE_ADDR']]

It should work for CDN where IP addresses are dynamic.

This is explained in the following comment:

 * In order for this setting to be used you must specify every possible
 * reverse proxy IP address in $settings['reverse_proxy_addresses'].
 * If a complete list of reverse proxies is not available in your
 * environment (for example, if you use a CDN) you may set the
 * $_SERVER['REMOTE_ADDR'] variable directly in settings.php.
 * Be aware, however, that it is likely that this would allow IP
 * address spoofing unless more advanced precautions are taken

Drupal 7

$conf['reverse_proxy'] = TRUE;
$conf['reverse_proxy_addresses'] = [@$_SERVER['REMOTE_ADDR']];

Related: Setting reverse_proxy and reverse_proxy_addresses behind AWS ELBs.


In your settings.php file, you can add the following line:

$base_url = 'https://www.yourdomain.com';
  • then all content will be served from yourdomain.com? I'd rather avoid serving all the content encrypted... – starsinmypockets Aug 30 '11 at 17:16

$base_url=''; worked for me, but note that bootstrap will puke on it, and needs the following change:


if (isset($base_url)) { 

//change to (should be this way anyway?):

if (isset($base_url) && $base_url!='') {
  • Rather than setting $base_url to empty, if you unset it in settings.php then there's no need to hack bootstrap.inc unset($base_url); – martinjbaker Sep 11 '13 at 11:01
  • It's not a good practice to edit drupal core files so I suggest to take a look at my answer and use that approach instead. – Sohail Oct 9 '13 at 11:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.