How to use HTTPS in vBulletin 3x & 4x – Mixed Content Solution

If a site is not on HTTPS, Chrome version 56+ will mark it as “not secure” for password and other sensitive information fields. In vBulletin 3.x and 4.x, using HTTPS is not out of the box.

Let’s make the vBulletin vBulletin 3.x and vBulletin 4.x over to HTTPS in 5 simple steps.

1. Install SSL Certificate for the domain

First, we need to install the SSL certificate for the domain. You can purchase an SSL and install it or can use Let’s Encrypt’s Free SSL provided your hosts offer it.

Once the SSL is installed for the domain, you should browse the forum of HTTPS. It shouldn’t throw a complete SSL warning but some part of the forum will load whereas others won’t.

2. Change Forum URL

Now login to the Admin CP and under vBulletin Options, we have Site Name / URL / Contact Details under which there is an option to set Forum URL. If it is http://yourdomain make it https://yourdomain

3. Change StyleVars

In vBulletin 3.x, unless you have changed to absolute image URLs, it is completely ok to skip this step.

Check under Styles & Templates > Style Manager > For your style from the drop-down edit Stylevars.

Make sure Image Paths for the vBulletin are either relative to the forum root or if they have an absolute path, it is HTTPS and not HTTP

In vBulletin 4.x typically the logo URL is often an absolute URL with HTTP instead of HTTPS. Ideally, it should not be the case.

Still, under Style Styles & Templates, for “Style Variables” check for the title image to make sure the path is either relative to the forum root or if they have an absolute path, it is https and not HTTP

4. Search vBulletin Templates for any HTTP://

Ideally, if your templates aren’t modified you can skip this step. However, if you have Google Analytics code or other Ad embeds for the HTTP domain, you need to replace them to be on the HTTPS domain.

Under Styles & Templates, there is an option to Search in Templates. Use the search to find any occurrence of HTTP URLs instead of HTTPS for images, CSS, or scripts and replace them with HTTPS.

5. Route Images Via Image Proxy Script

We have the design which includes CSS and JS and images change fairly easily. However, the issue will be for user content where images are embedded from other non-HTTPS based sites.

The solution is in two parts.

Part 1: Proxy PHP Script for Images

Here is a sample PHP proxy code using curl that can be used in vBulletin to route image embed URLs in posts through the proxy.

Create a PHP file and name it imgproxy.php in the root of the domain.

Part 2: Route IMG Tag to use Proxy for non-secure Images

For nonsecure IMG URLs, override the final url of the image to route through the above proxy. Make sure you are using the same secure salt and hashing to avoid any hacking attempts with the proxy.

In the Admin CP > Plugins & Products > Add New Plugin

Select the Hook Location as bbcode_img_match and Title as HTTPS for vBulletin add the following code in the Plugin PHP Code

And make sure you have selected the plugin is active to Yes.

The above code assumes that you have uploaded the image proxy file to the server and named it as imgproxy.php in the root of the domain.

6. Check Other Paths

In some vBulletin forums, the smiley paths or avatar (Custom or built-in) paths are absolute paths. So when that user has a post in a thread, it may throw a mixed content warning. Make sure to check those paths for either relative URLs or have HTTPS-based URLs.

7. Finally, Redirect HTTP to HTTPS

The vBulletin forum is now available on HTTP url as well as HTTPS url. It is good practice to redirect the HTTP version of the site to HTTPS using htaccess. Here is the simple code one can add right at the top of the htaccess file.