# Https \> can't login to panel

**URL:** <https://forum.getkirby.com/t/https-cant-login-to-panel/17613>\
**Category:** Questions\
**Tags:** v3\
**Created:** [March 16, 2020, 8:05am UTC](https://forum.getkirby.com/t/https-cant-login-to-panel/17613 "2020-03-16T08:05:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![coko](https://avatars.discourse-cdn.com/v4/letter/c/f17d59/32.png) [@coko](https://forum.getkirby.com/u/coko)\
**Post date:** [March 16, 2020, 8:05am UTC](https://forum.getkirby.com/t/https-cant-login-to-panel/17613/1 "2020-03-16T08:05:46Z")

</div>

After site deployment and forcing https and domain without www like this:

```auto
RewriteCond %{HTTP_HOST} !=localhost
RewriteCond %{HTTP_HOST} ^www\. [NC,OR]
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L,NE]

```

I can’t login to the panel:

```auto
The panel cannot connect to the API

```

After removing the accounts folder I tried:

```auto
return [
  'panel' =>[
    'install' => true
  ]
];

```

But no joy:

```auto
Failed to fetch

```

I **can** login after I remove the htaccess rules, using http.  
(kirby 3.3.4)

I’m using chrome, and this seems to be blocked by a CORS policy:

```auto
login:1 Access to fetch at 'xxx' from origin 'https://mydomain.nl' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.
www.mydomain.nl/api/system?view=panel:1 Failed to load resource: net::ERR_FAILED

```

I had some add blocker installed I’ve disabled it but no change and Safari shows the same error.

Tried Allow cross-origin requests from HTML5bp:

```auto
<IfModule mod_headers.c>
  Header set Access-Control-Allow-Origin "*"
</IfModule>

```

But no change.  
Not sure how to proceed, help is appreciated.

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 16, 2020, 9:51am UTC](https://forum.getkirby.com/t/https-cant-login-to-panel/17613/2 "2020-03-16T09:51:34Z")

</div>

Did you put that at the top of the .htacess? Have you checked if you can set the redirect in your hosting provider’s control panel instead of in `.htaccess`?

---

<div class="post-metadata">

**Author:** ![coko](https://avatars.discourse-cdn.com/v4/letter/c/f17d59/32.png) [@coko](https://forum.getkirby.com/u/coko)\
**Post date:** [March 16, 2020, 10:25am UTC](https://forum.getkirby.com/t/https-cant-login-to-panel/17613/3 "2020-03-16T10:25:20Z")

</div>

my htaccess file:

```auto
# Kirby .htaccess

# rewrite rules
<IfModule mod_rewrite.c>

# enable awesome urls. i.e.:
# http://yourdomain.com/about-us/team
RewriteEngine on

RewriteCond %{HTTP_HOST} !=localhost
RewriteCond %{HTTP_HOST} ^www\. [NC,OR]
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L,NE]

# make sure to set the RewriteBase correctly
# if you are running the site in a subfolder.
# Otherwise links or the entire site will break.
#
# If your homepage is http://yourdomain.com/mysite
# Set the RewriteBase to:
#
# RewriteBase /mysite

# In some environments it's necessary to
# set the RewriteBase to:
#
#RewriteBase /

# block files and folders beginning with a dot, such as .git
# except for the .well-known folder, which is used for Let's Encrypt and security.txt
RewriteRule (^|/)\.(?!well-known\/) index.php [L]

# block text files in the content folder from being accessed directly
RewriteRule ^content/(.*)\.(txt|md|mdown)$ index.php [L]

# block all files in the site folder from being accessed directly
# except for requests to plugin assets files
RewriteRule ^site/(.*) index.php [L]

# Enable authentication header
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

# block direct access to kirby and the panel sources
RewriteRule ^kirby/(.*) index.php [L]

# make site links work
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*) index.php [L]

</IfModule>

# compress text file responses
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE application/json
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

```

I will have look if I can set it in DirectAdmin …

---

<div class="post-metadata">

**Author:** ![coko](https://avatars.discourse-cdn.com/v4/letter/c/f17d59/32.png) [@coko](https://forum.getkirby.com/u/coko)\
**Post date:** [March 16, 2020, 10:45am UTC](https://forum.getkirby.com/t/https-cant-login-to-panel/17613/4 "2020-03-16T10:45:55Z")

</div>

I have set in DirectAdmin:

- Force Redirect www.mydomain.nl \>mydomain.nl
- Redirect HTTP to HTTPS

Added the underneath to: site \> config \> config.www.mydomain.nl.php:

```auto
  'panel' =>[
    'install' => true
  ]

```

Deleted site \> accounts

And I was able to install the panel.  
Thanks @texnixe

Did I ever tell you, you are awesome? No?  
You are A W E S O M E 😃

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 16, 2020, 11:34am UTC](https://forum.getkirby.com/t/https-cant-login-to-panel/17613/5 "2020-03-16T11:34:12Z")

</div>

Thank you 🙂! Always happy when problems get solved.