PHP Get Site URL Protocol - http vs https

Question

I've written a little function to establish the current site url protocol but I don't have SSL and don't know how to test if it works under https. Can you tell me if this is correct?

function siteURL()
{
    $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https://" : "http://";
    $domainName = $_SERVER['HTTP_HOST'].'/';
    return $protocol.$domainName;
}
define( 'SITE_URL', siteURL() );

Is it necessary to do it like above or can I just do it like?:

function siteURL()
{
    $protocol = 'http://';
    $domainName = $_SERVER['HTTP_HOST'].'/'
    return $protocol.$domainName;
}
define( 'SITE_URL', siteURL() );

Under SSL, doesn't the server automatically convert the url to https even if the anchor tag url is using http? Is it necessary to check for the protocol?

Thank you!

Wouldn't it be a better option for you to install a local web server and throw a self signed SSL certificate on it? That way you can test it for yourself. — Frazell Thomas
– Frazell Thomas, Commented Dec 21, 2010 at 19:34
While this doesn't answer your question, a better solution to your problem (though I can't be sure without knowing more) might be to use Protocol Relative URLs. — Reese Moore
– Reese Moore, Commented Dec 21, 2010 at 19:46
Just a quick question...how come you're doing a function if it's not dynamic. It's not like you feed it any vars to change the url. Why not define a constant? That's what I did. $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https://" : "http://"; define('SITE_URL', $protocol.$_SERVER['HTTP_HOST'].'/'); — HTMLGuy
– HTMLGuy, Commented Jan 26, 2013 at 23:58
May I suggest this? stackoverflow.com/questions/6768793/get-the-full-url-in-php — Timo Huovinen
– Timo Huovinen, Commented Apr 16, 2014 at 14:45

Rid Iculous · Accepted Answer · 2013-01-11 01:17:38Z

112

This works for me

if (isset($_SERVER['HTTPS']) &&
    ($_SERVER['HTTPS'] == 'on' || $_SERVER['HTTPS'] == 1) ||
    isset($_SERVER['HTTP_X_FORWARDED_PROTO']) &&
    $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
  $protocol = 'https://';
}
else {
  $protocol = 'http://';
}

answered Jan 11, 2013 at 1:17

Rid Iculous

3,9783 gold badges25 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Jesús Carrera Over a year ago

This is the solution that works if using a proxy (like in my case CloudFlare)

Mark Fisher Over a year ago

This is correct - you shouldn't assume https just because you're using port 443.

Tayyab Hayat Over a year ago

This work fine with normal links as well as with CDN, thanks

PiggyMacPigPig Over a year ago

Would it be of benefit to apply the PHP strtolower() Function to the portion of the above code ($_SERVER['HTTPS'])== 'on') so that it read strtolower($_SERVER['HTTPS']) == 'on' and therefore allowing for instances where the value returned from $_SERVER['HTTPS'] is On or ON?

ashleedawg · Accepted Answer · 2019-10-11 07:39:57Z

91

I know it's late, although there is a much more convenient way to solve this kind of problem! The other solutions are quite messy; this is how I would do it:

$protocol = stripos($_SERVER['SERVER_PROTOCOL'],'https') === 0 ? 'https://' : 'http://';

...or even without condition if you prefer:

$protocol = strtolower(substr($_SERVER["SERVER_PROTOCOL"],0,strpos( $_SERVER["SERVER_PROTOCOL"],'/'))).'://';

Have a look at $_SERVER["SERVER_PROTOCOL"]

edited Oct 11, 2019 at 7:39

ashleedawg

21.9k9 gold badges82 silver badges120 bronze badges

answered Feb 26, 2013 at 23:21

ivoputzer

6,4811 gold badge27 silver badges43 bronze badges

12 Comments

wormhit Over a year ago

This dont work with "https" stackoverflow.com/questions/16825243/…

ivoputzer Over a year ago

@wormhit it mainly depends on how your webserver is configured though

Fred Over a year ago

Any reason why you use stripos instead of strpos?

regilero Over a year ago

$_SERVER['SERVER_PROTOCOL'] is made to store HTTP/1.0 or HTTP/1.1 depending on the protocol version, what sort of HTTP server configuration do you talk about, storing https information on this string coming from the http query?

Simon Hi Over a year ago

Doesn't work in my case! $_SERVER['SERVER_PROTOCOL'] contains "HTTP" (without any "S") while the protocol is https. Checking $_SERVER['HTTPS'] is more appropriate.

|

profitphp · Accepted Answer · 2010-12-21 19:38:31Z

75

It is not automatic. Your top function looks ok.

answered Dec 21, 2010 at 19:38

profitphp

8,4022 gold badges30 silver badges21 bronze badges

3 Comments

I wrestled a bear once. Over a year ago

worth noting that it IS automatic if you just leave off the protocol.. ie //mysqite.com instead of https://mysitecom

TimoSolo Over a year ago

@Pamblam, // works great unless your link is in an email :)

Lucas Over a year ago

Or in an xhr request

softcod.com · Accepted Answer · 2015-02-20 17:37:54Z

30

short way

$scheme = $_SERVER['REQUEST_SCHEME'] . '://';

answered Feb 20, 2015 at 17:37

softcod.com

5806 silver badges8 bronze badges

2 Comments

Farnabaz Over a year ago

REQUEST_SCHEME is not reliable

KenB Over a year ago

REQUEST_SCHEME is not available until Apache 2.4.

Dave Jarvis · Accepted Answer · 2014-03-29 02:46:46Z

28

Some changes:

function siteURL() {
  $protocol = ((!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') || 
    $_SERVER['SERVER_PORT'] == 443) ? "https://" : "http://";
  $domainName = $_SERVER['HTTP_HOST'];
  return $protocol.$domainName;
}

edited Mar 29, 2014 at 2:46

Dave Jarvis

31.3k43 gold badges186 silver badges326 bronze badges

answered Sep 11, 2012 at 6:42

Anoop K

2813 silver badges3 bronze badges

Comments

alex · Accepted Answer · 2014-10-01 15:50:34Z

7

Because testing port number is not a good practice according to me, my solution is:

define('HTTPS', isset($_SERVER['HTTPS']) && filter_var($_SERVER['HTTPS'], FILTER_VALIDATE_BOOLEAN));

The HTTPSconstant returns TRUE if $_SERVER['HTTPS'] is set and equals to "1", "true", "on" or "yes". Returns FALSE otherwise.

edited Oct 1, 2014 at 15:50

answered Oct 1, 2014 at 15:43

alex

5,7616 gold badges36 silver badges56 bronze badges

2 Comments

Daniel Dewhurst Over a year ago

This is probably the best answer. Lots of these answers will will only in a percentage of situations. For example, people are just checking if $_SERVER['HTTPS'] is set. Many frameworks set this variable as false or 'off' etc, therefore checking if it's simply set will not work.

Dave Morton Over a year ago

While this works under most situations, there have been times where there was a configuration SNAFU and $_SERVER['HTTPS'] was actually set to "off". Your code would still regard that as "passing" the test, so should be amended to allow for that particular setting.

Community · Accepted Answer · 2017-05-23 11:55:00Z

7

For any system except IIS this is quite enough to define site self URL:

$siteURL='http'.(empty($_SERVER['HTTPS'])?'':'s').'://'.$_SERVER['HTTP_HOST'].'/';

or

$siteURL='http'.(empty($_SERVER['HTTPS'])?'':'s').'://'.$_SERVER['SERVER_NAME'].'/';

depends on what you exactly want: HTTP_HOST vs. SERVER_NAME

edited May 23, 2017 at 11:55

CommunityBot

11 silver badge

answered Sep 15, 2016 at 18:17

Eugene Zakharenko

1452 silver badges7 bronze badges

Comments

Guillaume · Accepted Answer · 2018-07-03 09:40:05Z

7

Extracted from CodeIgniter :

if ( ! function_exists('is_https'))
{
    /**
     * Is HTTPS?
     *
     * Determines if the application is accessed via an encrypted
     * (HTTPS) connection.
     *
     * @return  bool
     */
    function is_https()
    {
        if ( ! empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off')
        {
            return TRUE;
        }
        elseif (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) === 'https')
        {
            return TRUE;
        }
        elseif ( ! empty($_SERVER['HTTP_FRONT_END_HTTPS']) && strtolower($_SERVER['HTTP_FRONT_END_HTTPS']) !== 'off')
        {
            return TRUE;
        }

        return FALSE;
    }
}

answered Jul 3, 2018 at 9:40

Guillaume

4635 silver badges11 bronze badges

1 Comment

YakovL Over a year ago

no link to the source.. let me reference at least this

Community · Accepted Answer · 2017-05-23 11:47:30Z

6

Use this server variable to get the protocol details:

 $scheme = $_SERVER['REQUEST_SCHEME'] . '://';
 echo $scheme; //it gives http:// or https://

Note that this server variable is unreliable. For more information take a look at: Is $_SERVER['REQUEST_SCHEME'] reliable?

edited May 23, 2017 at 11:47

CommunityBot

11 silver badge

answered Jul 8, 2015 at 9:11

shashik493

8201 gold badge11 silver badges13 bronze badges

1 Comment

ndsmyter Over a year ago

Can you add some more information to your post, and not only the code? For example explain why this is an answer to the question?

Harshit · Accepted Answer · 2016-08-26 07:00:42Z

5

In case of proxy the SERVER_PORT may not give the correct value so this is what worked for me -

$protocol = ((!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') || $_SERVER['SERVER_PORT'] == 443 || $_SERVER['HTTP_X_FORWARDED_PORT'] == 443) ? "https://" : "http://"

answered Aug 26, 2016 at 7:00

Harshit

7311 gold badge9 silver badges31 bronze badges

Comments

Community · Accepted Answer · 2017-05-23 12:02:50Z

3

I've tested the most voted answer and it didn't work for me, I ended up using:

$protocol = isset($_SERVER['HTTPS']) ? 'https://' : 'http://';

edited May 23, 2017 at 12:02

CommunityBot

11 silver badge

answered May 13, 2016 at 15:10

Pedro Lobito

99.8k36 gold badges274 silver badges278 bronze badges

4 Comments

nathanfranke Over a year ago

Some web servers do not support $_SERVER["HTTPS"] and therefore your code may return http:// even if it should be https://

Pedro Lobito Over a year ago

If the server doesn't support, https, why would the code still return https?

nathanfranke Over a year ago

My server supports https but the $_SERVER["HTTPS"] variable is never defined.

Pedro Lobito Over a year ago

I'm confused by your 2 comments. It's probably better if you create a new answer that covers those special cases. Thanks and good luck!

Saurabh Chandra Patel · Accepted Answer · 2016-06-30 17:39:45Z

3

$protocal = 'http';
if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' || $_SERVER['HTTPS'] == 'on') {$protocal = 'https';}


echo $protocal;

answered Jun 30, 2016 at 17:39

Saurabh Chandra Patel

13.7k7 gold badges94 silver badges80 bronze badges

Comments

Shahzad Barkati · Accepted Answer · 2022-11-17 12:14:31Z

3

I know this is an old question but I came across this today since I needed to test for this in my site. It seems the answers above are needlessly complicated. To establish the site protocol, all you have to do is test $_SERVER['HTTPS']

If the protocol is using HTTPS, then $_SERVER['HTTPS'] will return 'on'. If not, the variable will remain empty. For example:

test if HTTPS is being used. If it is, the echo will return '$SSL_test: on'. If not HTTPS, '$SSL_test' will remain empty.

$SSL_test = $_SERVER['HTTPS'];

echo '<p>$SSL_test: '.$SSL_test.'</p>';
    
if($SSL_test == true) {
    echo 'You\'re using SSL';
} else {
    echo 'You\'re not using SSL';
}

You can use the above to easily and cleanly test for HTTPS and implement accordingly. :)

edited Nov 17, 2022 at 12:14

Shahzad Barkati

2,5506 gold badges28 silver badges34 bronze badges

answered Apr 2, 2018 at 23:21

Rob Stocki

1561 silver badge10 bronze badges

1 Comment

Chris-MindflowAU Over a year ago

Not every server has this $_SERVER['HTTPS']

miyuru · Accepted Answer · 2014-05-10 06:28:17Z

2

made a function using the Rid Iculous's answer which worked on my system.

function site_protocol() {
    if(isset($_SERVER['HTTPS']) && ($_SERVER['HTTPS'] == 'on' || $_SERVER['HTTPS'] == 1) || isset($_SERVER['HTTP_X_FORWARDED_PROTO']) &&  $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')  return $protocol = 'https://'; else return $protocol = 'http://';
}

Hope it helps

answered May 10, 2014 at 6:28

miyuru

1,23113 silver badges20 bronze badges

Comments

Scotty G · Accepted Answer · 2017-11-14 17:54:54Z

2

Here is how I do it ... it is a shorthand if else version of Rid Iculous's answer ...

$protocol = isset($_SERVER['HTTPS']) && ($_SERVER['HTTPS'] === 'on' || $_SERVER['HTTPS'] === 1) || isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ? 'https' : 'http';

answered Nov 14, 2017 at 17:54

Scotty G

4223 silver badges8 bronze badges

Comments

koalaok · Accepted Answer · 2020-02-19 14:24:15Z

1

I think the complete func should look like :

function siteURL()
{
    $protocol =  "http://";
    if (
        //straight
        isset($_SERVER['HTTPS']) && in_array($_SERVER['HTTPS'], ['on', 1])
        ||
        //proxy forwarding
        isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https'
    ) {
        $protocol = 'https://';
    }

    $domainName = $_SERVER['HTTP_HOST'];
    return $protocol . $domainName;
}

Notes:

you should look also for HTTP_X_FORWARDED_PROTO (e.g. if proxy server)
relying on 443 port is not safe (https could be served on different port)
REQUEST_SCHEME not reliable

answered Feb 19, 2020 at 14:24

koalaok

5,85012 gold badges63 silver badges96 bronze badges

Comments

Aranxo · Accepted Answer · 2022-06-02 00:41:50Z

1

Also late to the party, but here is a much shorter version of Rid Iculous's answer using the Null Coalescing Operator:

$is_ssl = in_array($_SERVER['HTTPS'] ?? '', ['on', 1]) ||
          ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') == 'https';
$protocol = $is_ssl ? 'https://' : 'http://';

Or:

$protocol = in_array($_SERVER['HTTPS'] ?? '', ['on', 1]) ||
            ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') == 'https' ?
            'https://' : 'http://';

answered Jun 2, 2022 at 0:41

Aranxo

1,42311 silver badges18 bronze badges

Comments

Jhoel Rhocher · Accepted Answer · 2017-05-18 16:15:45Z

0

it's the best solution of https or http use this :

<?php
$protocol = '//';  
$site_url = $protocol.$_SERVER["HTTP_HOST"];
?>

But can't display https or http, so it only use to link your site content like image, etc.

if want to redirect your site in https, add this code in .htaccess file :

<IfModule mod_rewrite.c>
 RewriteCond %{HTTP:CF-Visitor} '"scheme":"http"'
 RewriteRule ^(.*)$ https://www.your-domain.com$1 [L]
</IfModule>

Change www.your-domain.com with your dowmain name.

answered May 18, 2017 at 16:15

Jhoel Rhocher

11 bronze badge

Comments

Jon · Accepted Answer · 2020-03-05 01:24:46Z

0

I know I'm a bit late to this party, but if you much prefer not using $_SERVER as it's strongly discouraged, and even deactivated on some PHP frameworks; and you have an apache web server, you can use it's native command thusly: -

$protocol = apache_getenv('HTTPS') ? 'https:' : 'http:';

answered Mar 5, 2020 at 1:24

Jon

8502 gold badges11 silver badges19 bronze badges

Collectives™ on Stack Overflow

PHP Get Site URL Protocol - http vs https

19 Answers 19

4 Comments

12 Comments

3 Comments

2 Comments

Comments

2 Comments

Comments

1 Comment

1 Comment

Comments

4 Comments

Comments

1 Comment

Comments

Comments

Comments

Comments

Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

19 Answers 19

4 Comments

12 Comments

3 Comments

2 Comments

Comments

2 Comments

Comments

1 Comment

1 Comment

Comments

4 Comments

Comments

1 Comment

Comments

Comments

Comments

Comments

Comments

Comments

Linked

Related