Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am servicing some web pages over SSL.
The problem is that all the images, CSS and JS files are included on these pages using relatives paths (/images/save.png), thus the browser requests them on SSL. That's a bit of a waste.

Is there a way to configure Apache in order not to serve images, CSS and JS files over SSL, even if it is requested to?

share|improve this question

migrated from Feb 15 '11 at 16:42

This question came from our site for computer enthusiasts and power users.

Some browsers will pop-up a security warning dialogue if some elements of an HTTPS page are served with HTTP. – RedGrittyBrick Feb 15 '11 at 16:45
Advanced warning: most browser will through up an error if there is mixed secure/non-secure content. – Coops Feb 15 '11 at 16:55

I wouldn't recommend doing so since every client will receive a warning about the mixed ssl/non ssl content. But you asked:

RewriteEngine On
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !(\.js|\.css)$ [NC]
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI}


As @lekensteyn pointed out correctly, this is a not to underestimate waste of resources. Rewriting is not really performing well in that situation. Also the RewriteConditions have to be matched for each and every request to the files.

You will also need more open TCP Ports, which again produces overhead. And even if we don't go into detail that much there will be a significant overhead for having two protocols doing ones' job.

share|improve this answer
+1 for "Don't do that! (but here's how)" -- It's pretty much guaranteed that your users will get a big unfriendly WARNING box about mixed content (and if you sprang for an EV SSL certificate I believe this also keeps the URL bar from turning green)... – voretaq7 Feb 15 '11 at 16:56
I find a redirect more wasteful than serving images/js/css over HTTPS. If you really want these files to be served over an unencrypted channel, you'd better rewriting the URL's in your HTML files. – Lekensteyn Feb 15 '11 at 17:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.