# HTTPS breaking Panel

**URL:** <https://forum.getkirby.com/t/https-breaking-panel/17749>\
**Category:** Questions\
**Created:** [March 31, 2020, 7:35pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749 "2020-03-31T19:35:28Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 7:35pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/1 "2020-03-31T19:35:28Z")

</div>

I’m setting up a project for a client and have hit a roadblock.

Tried to force HTTPS several ways (HTACCESS seemed most succesful/robust), and even though site functions and redirects correctly to HTTPS, the panel gives a 404.

Relatively new to Kirby, is there anything I need to define or amend beyond ‘ssl’ =\> true, in the config.php?

_For context I had just set up server with SSL certificate from LetsEncrypt using CertBot and forced site wide HTTPS._

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 31, 2020, 7:43pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/2 "2020-03-31T19:43:07Z")

</div>

> [@Ian\_Batt](#):
>
> ‘ssl’ =\> true,

There is no such setting for Kirby 3, that setting only existed in Kirby 2.

Is the site already online? Could you post the link?

---

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 7:45pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/3 "2020-03-31T19:45:32Z")

</div>

Site is here REDACTED

edit: also adding in that the aim is to force HTTPS and also non-www. Thanks!

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 31, 2020, 8:19pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/4 "2020-03-31T20:19:57Z")

</div>

Does the Panel work if you don’t enforce HTTPS? Since the site doesn’t have subpages, I couldn’t test if subpages work and thus if this is rather a problem with URL rewriting.

---

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 8:24pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/5 "2020-03-31T20:24:13Z")

</div>

Yes, exactly, the panel works when removing HTTPS enforcements from HTACCESS …

With it on, /panel also seems to push to /home (still 404).

Any suggestions?

edit: I’ve temporarily removed relevant code I had put into HTACCESS and config.php

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 31, 2020, 8:54pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/6 "2020-03-31T20:54:07Z")

</div>

And what did you put into your `.htaccess` to enforce https/non-www? Could you please post the complete htaccess?

---

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 9:00pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/7 "2020-03-31T21:00:36Z")

</div>

Change of tack. These rules added to server .config;

```
<VirtualHost *:80>
ServerName my.domain
Redirect permanent / https://my.domain/
</VirtualHost>

<VirtualHost _default_:443>
ServerName my.domain
DocumentRoot /var/www/html
SSLEngine On
...
</VirtualHost>

```

And this is to HTACCESS

```
# Kirby .htaccess

# rewrite rules
<IfModule mod_rewrite.c>

# enable awesome urls. i.e.:
# http://yourdomain.com/about-us/team
RewriteEngine on

# make sure to set the RewriteBase correctly
# if you are running the site in a subfolder.
# Otherwise links or the entire site will break.
#
# If your homepage is http://yourdomain.com/mysite
# Set the RewriteBase to:
#
# RewriteBase /mysite

# In some environments it's necessary to
# set the RewriteBase to:
#
# RewriteBase /

# block files and folders beginning with a dot, such as .git
# except for the .well-known folder, which is used for Let's Encrypt and security.txt
RewriteRule (^|/)\.(?!well-known\/) index.php [L]

# block text files in the content folder from being accessed directly
RewriteRule ^content/(.*)\.(txt|md|mdown)$ index.php [L]

# block all files in the site folder from being accessed directly
# except for requests to plugin assets files
RewriteRule ^site/(.*) index.php [L]

# Enable authentication header
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

# block direct access to kirby and the panel sources
RewriteRule ^kirby/(.*) index.php [L]

# make site links work
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*) index.php [L]
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

</IfModule>

# compress text file responses
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE application/json
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

```

I can access and log into panel at [http://www.domain/panel](http://www.domain/panel) but not https

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 31, 2020, 9:03pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/8 "2020-03-31T21:03:22Z")

</div>

These https/non-www should be at the top of the htaccess after RewriteEngine on.

---

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 9:08pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/9 "2020-03-31T21:08:50Z")

</div>

have moved here:

```
# Kirby .htaccess

# rewrite rules
<IfModule mod_rewrite.c>

# enable awesome urls. i.e.:
# http://yourdomain.com/about-us/team
RewriteEngine on

RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

# make sure to set the RewriteBase correctly
# if you are running the site in a subfolder.
# Otherwise links or the entire site will break.
#
# If your homepage is http://yourdomain.com/mysite
# Set the RewriteBase to:
#
# RewriteBase /mysite

# In some environments it's necessary to
# set the RewriteBase to:
#
# RewriteBase /

# block files and folders beginning with a dot, such as .git
# except for the .well-known folder, which is used for Let's Encrypt and security.txt
RewriteRule (^|/)\.(?!well-known\/) index.php [L]

# block text files in the content folder from being accessed directly
RewriteRule ^content/(.*)\.(txt|md|mdown)$ index.php [L]

# block all files in the site folder from being accessed directly
# except for requests to plugin assets files
RewriteRule ^site/(.*) index.php [L]

# Enable authentication header
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

# block direct access to kirby and the panel sources
RewriteRule ^kirby/(.*) index.php [L]

# make site links work
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*) index.php [L]

</IfModule>

# compress text file responses
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE application/json
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

```

Still no joy

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 31, 2020, 9:22pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/10 "2020-03-31T21:22:46Z")

</div>

Hm, I don’t know. These were the rules someone suggested in the past:

```auto
RewriteCond %{HTTP_HOST} !=localhost
RewriteCond %{HTTP_HOST} ^www\. [NC,OR]
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L,NE]

```

But if you have access to the server configuration anyway, you might as well set up a Virtual host for www and do the rewrite there.

---

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 9:26pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/11 "2020-03-31T21:26:07Z")

</div>

I’ve udpated HTACCESS to:

```
# Kirby .htaccess

# rewrite rules
<IfModule mod_rewrite.c>

# enable awesome urls. i.e.:
# http://yourdomain.com/about-us/team
RewriteEngine on
RewriteCond %{HTTP_HOST} abroad\.studio [NC]
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://abroad.studio/$1 [R,L]

# make sure to set the RewriteBase correctly
# if you are running the site in a subfolder.
# Otherwise links or the entire site will break.
#
# If your homepage is http://yourdomain.com/mysite
# Set the RewriteBase to:
#
# RewriteBase /mysite

# In some environments it's necessary to
# set the RewriteBase to:
#
# RewriteBase /

# block files and folders beginning with a dot, such as .git
# except for the .well-known folder, which is used for Let's Encrypt and security.txt
RewriteRule (^|/)\.(?!well-known\/) index.php [L]

# block text files in the content folder from being accessed directly
RewriteRule ^content/(.*)\.(txt|md|mdown)$ index.php [L]

# block all files in the site folder from being accessed directly
# except for requests to plugin assets files
RewriteRule ^site/(.*) index.php [L]

# Enable authentication header
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

# block direct access to kirby and the panel sources
RewriteRule ^kirby/(.*) index.php [L]

# make site links work
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*) index.php [L]

</IfModule>

# compress text file responses
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE application/json
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

```

HTTPS getting forced, non-www not being enforced (ugh) but still getting this on /Panel

```
# Not Found

The requested URL was not found on this server.

Apache/2.4.29 (Ubuntu) Server at www.abroad.studio Port 443

```

very frustrating !

---

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 9:28pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/12 "2020-03-31T21:28:48Z")

</div>

> [@texnixe](#):
>
> RewriteCond %{HTTP\_HOST} !=localhost RewriteCond %{HTTP\_HOST} ^www. [NC,OR] RewriteCond %{HTTPS} off RewriteCond %{HTTP\_HOST} ^(?:www.)?(.+)$ [NC] RewriteRule ^ https://%1%{REQUEST\_URI} [R=301,L,NE]

Which config file do you recommend I put this?

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 31, 2020, 9:31pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/13 "2020-03-31T21:31:29Z")

</div>

> [@Ian\_Batt](#):
>
> Which config file do you recommend I put this?

Not config, htaccess, as I said, that was something suggested in the past. But htaccess rules that work on one server don’t necessarily work on another. Therefore this needs a bit of testing what works and what does not.

What about my second suggestion?

---

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 9:36pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/14 "2020-03-31T21:36:51Z")

</div>

To set up virtualhost and redirect there? If there is a chance this might resolve the issue then might have to.

Any idea why the rest of the site might work on HTTPS but the panel doesn’t?

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 31, 2020, 9:39pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/15 "2020-03-31T21:39:46Z")

</div>

Another thing you can try is set the url in config.

> **[url](https://getkirby.com/docs/reference/system/options/url)**
>
> Set the base URL for the site.

---

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 9:41pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/16 "2020-03-31T21:41:44Z")

</div>

Tried that earlier, and again now — seems to break the whole site.

Blank page not 404 though.

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 31, 2020, 9:43pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/17 "2020-03-31T21:43:42Z")

</div>

> [@Ian\_Batt](#):
>
> Tried that earlier, and again now — seems to break the whole site.

Setting the url in config should break the site.

Anyway, need to stop for tonight and get some sleep.

---

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 9:46pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/18 "2020-03-31T21:46:59Z")

</div>

Ok, likewise, thanks for your help tonight.

Any other thoughts on what might be causing the issue very welcome.

---

<div class="post-metadata">

**Author:** ![Adspectus](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/adspectus/32/189_2.png) [@Adspectus](https://forum.getkirby.com/u/Adspectus)\
**Post date:** [March 31, 2020, 10:25pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/19 "2020-03-31T22:25:42Z")

</div>

You do not need any rewrite rules for https in .htaccess if you enforce redirection in your server config like you do. Furthermore I would write it like so:

```auto
<VirtualHost YOUR_IP:80>
ServerName abroad.studio
RedirectPermanent / https://abroad.studio/
</VirtualHost>

<VirtualHost YOUR_IP:443>
ServerName abroad.studio
DocumentRoot /var/www/html
SSLEngine On
...
</VirtualHost>

```

With redirection in server config your webserver will enforce everything to https even before he will know what exactly is at the document root, and therefore even before .htaccess file is evaluated.

---

<div class="post-metadata">

**Author:** ![Ian\_Batt](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ian_batt/32/8285_2.png) [@Ian\_Batt](https://forum.getkirby.com/u/Ian_Batt)\
**Post date:** [March 31, 2020, 10:36pm UTC](https://forum.getkirby.com/t/https-breaking-panel/17749/20 "2020-03-31T22:36:41Z")

</div>

**SOLUTION** Added @Adspectus rules + a directory listing to 443 config

```
<VirtualHost *:80>
     ServerName my.domain
     RedirectPermanent / https://my.domain/
</VirtualHost>

<VirtualHost MY.SERVER.IP:443>
     ServerName my.domain
     DocumentRoot /var/www/html
            <Directory /var/www/html>
                Options Indexes FollowSymLinks
                AllowOverride All
                Require all granted
            </Directory>
     SSLEngine On
...
</VirtualHost>
```