I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome allows me to browse to my domain via https).

I'm getting a bunch of error messages like this:

The page at https://example.com/ ran insecure content from http://www.example.com/sites/default/files/css/css_TsVRTbLFUpEZAfw-_bWPJu840QT523CPjUVJ5MRWfyk.css

There are about 20-30 of these errors - mostly .js and .css files, some .png etc. Questions:

  1. How can I configure d7 so that it accesses these files via relative paths

  2. Are there any other workarounds here, to enable https on my drupal install?

Much thanks in advance.

7 Answers 7


Somewhat ugly, but you can do something like this for Drupal 6

function mytheme_preprocess_page (&$vars)
  $vars['scripts'] = str_replace("http://www.example.com/", "/", $vars['scripts']);
  $vars['styles'] = str_replace("http://www.example.com/", "/", $vars['styles']);
  $vars['content'] = str_replace("http://www.example.com/", "/", $vars['content']);

or for Drupal 7

function mytheme_process_html (&$variables) {
  $variables['scripts'] = str_replace("http://www.example.com/", "/", $variables['scripts']);
  $variables['styles'] = str_replace("http://www.example.com/", "/", $variables['styles']);
  $variables['page'] = str_replace("http://www.example.com/", "/", $variables['page']);

You can be a bit smarter and use PREG, but have never run into the need. Note that there may be a few additional regions / variables that you need to do replacement on.

I normally put in something similar to handle hardcoded URLs from the WYSIWYG when migrating from a dev URL to a live one.

  • My $vars array doesn't contain the arrays you reference... Aug 30, 2011 at 18:36
  • 1
    Sorry. Overlooked the that you are using Drupal 7. I updated my answer to show both Drupal 6 and Drupal 7 versions.
    – mpdonadio
    Aug 30, 2011 at 19:43
  • Thanks so much - that's got me down to favicon.ico, that little bugger... Aug 30, 2011 at 20:17
  • $variables['head']
    – mpdonadio
    Aug 30, 2011 at 20:33
  • @starsinmypockets: imho; think the below answer is more drupalish.
    – chrisjlee
    Apr 23, 2012 at 19:03

Simply remove $base_url from your settings.php file; Drupal will detect $base_url automatically.

If you must set this value explicitly, you can add a little conditional logic to your settings file, such as:

if (isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on') {
  $base_url = 'https://example.com';
else {
  $base_url = 'http://example.com';
  • 1
    Removing $base_url and clearing the Drupal cache worked for me Jan 29, 2014 at 19:26
  • I had no $base_url set, but I hadn't cleared the cache since I turned on SSL. When I finally did, my image paths got regenerated so it worked.
    – colan
    Sep 10, 2014 at 19:26

I had the same issue. In my case the pre-processing worked fine. However, when the requests were coming in from our Load Balancer, the pre-processing was not working. Strange.

Even so, found an easier solution. Add - $base_url = ''; to the settings.php

This way both http and https requests work fine. All css calls, etc. constructed by Drupal become relative and start with "/sites/..." instead of "http://servername/sites/..."

IMHO the default, if no base_url is specified should be relative URLs and not absolute. May be a fix in the next version of Drupal?

  • I tried this approach and it worked perfectly, but I get a notice message: Notice: Undefined offset: 1 in drupal_settings_initialize() (line 758 of /includes/bootstrap.inc) on php 5.5 and nginx
    – Sohail
    Oct 9, 2013 at 11:06
  • try the answer I provided below
    – Sohail
    Oct 9, 2013 at 11:21

In setting.php file of drupal 7/6 add the following:

else {
  • This was the issue for me, my Drupal 7 site was sitting behind Cloudflare and I turned on https. Drupal thought it was serving http content, so wouldn't load css and js with (blocked:mixed-content).
    – Cameron
    Apr 18, 2018 at 23:35

If your website runs behind the reverse proxy (such as CloudFront), enable reverse_proxy setting.

Drupal 8

Apply the following settings in site's settings.php file:

$settings['reverse_proxy'] = TRUE;
$settings['reverse_proxy_addresses'] = [@$_SERVER['REMOTE_ADDR']]

It should work for CDN where IP addresses are dynamic.

This is explained in the following comment:

 * In order for this setting to be used you must specify every possible
 * reverse proxy IP address in $settings['reverse_proxy_addresses'].
 * If a complete list of reverse proxies is not available in your
 * environment (for example, if you use a CDN) you may set the
 * $_SERVER['REMOTE_ADDR'] variable directly in settings.php.
 * Be aware, however, that it is likely that this would allow IP
 * address spoofing unless more advanced precautions are taken

Drupal 7

$conf['reverse_proxy'] = TRUE;
$conf['reverse_proxy_addresses'] = [@$_SERVER['REMOTE_ADDR']];

Related: Setting reverse_proxy and reverse_proxy_addresses behind AWS ELBs.


In your settings.php file, you can add the following line:

$base_url = 'https://www.yourdomain.com';
  • then all content will be served from yourdomain.com? I'd rather avoid serving all the content encrypted... Aug 30, 2011 at 17:16

$base_url=''; worked for me, but note that bootstrap will puke on it, and needs the following change:


if (isset($base_url)) { 

//change to (should be this way anyway?):

if (isset($base_url) && $base_url!='') {
  • Rather than setting $base_url to empty, if you unset it in settings.php then there's no need to hack bootstrap.inc unset($base_url); Sep 11, 2013 at 11:01
  • It's not a good practice to edit drupal core files so I suggest to take a look at my answer and use that approach instead.
    – Sohail
    Oct 9, 2013 at 11:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.