# Wordpress plugin receives avatar URL with HTTP protocol if site uses HTTPS and no CDN
**URL:** https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605
**Category:** Support
**Created:** [March 8, 2017, 1:09am UTC](https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605 "2017-03-08T01:09:48Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@fortasse](https://meta.discourse.org/u/fortasse)
#### Post date: [March 8, 2017, 1:09am UTC](https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605/1 "2017-03-08T01:09:48Z")
Hello! I have a Discourse installation that should only be used over HTTPS. However, since we also serve that forum on a Tor hidden service, we cannot use the “force HTTPS” checkbox in the options menu.
This is normally all well and good, except the Wordpress plugin gets an `http` url for the “avatar\_template” value. I believe this is because `discourse/app/serializers/post_wordpress_serializer.rb` (and the other wordpress-related serializers) use `UrlHelper.absolute object.user.avatar_template`. This calls `Discourse.base_url_no_prefix` if a CDN is not configured (which is not on our site.) As such, the Wordpress plugin attempts to fetch (and embeds) the avatars over HTTP, which is less than ideal. I’m not terribly well versed in Ruby, so if this is completely incorrect I apologize. I can say for certain, however, that the API response from wordpress.json has a value of `"avatar_template":"http://forums.whonix.org/letter_avatar_proxy/v2/letter/m/d2c977/{size}.png"` even though we have the `Discourse URL` value in the Wordpress plugin settings as “[https://forums.whonix.org](https://forums.whonix.org)”
I’m not sure if this is a bug in Discourse or the Wordpress plugin (or perhaps both) but I thought I would post it here. Please redirect me to the appropriate location if this is not it.
If you need additional details, please let me know.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 8, 2017, 2:53am UTC](https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605/2 "2017-03-08T02:53:11Z")
> [@fortasse](#):
>
> have a Discourse installation that should only be used over HTTPS. However, since we also serve that forum on a Tor hidden service, we cannot use the “force HTTPS” checkbox in the options menu.
This is … very bizarre. Either you are https, or you are not, there is no in between magical state.
---
### Author:  [@fortasse](https://meta.discourse.org/u/fortasse)
#### Post date: [March 8, 2017, 2:59am UTC](https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605/3 "2017-03-08T02:59:39Z")
You’re not wrong, it’s a very strange use case. The reason is that we cannot get TLS certificates for our Tor hidden service currently, so we are forced to run with an HTTP listener explicitly for the hidden service. That being said, when accessing the site of the “regular” Internet, we have HSTS and force redirects to the HTTPS version of the site.
If we use the “force HTTPS” checkbox, the Discourse instance will no longer work properly when accessed via the Tor hidden service.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 8, 2017, 3:00am UTC](https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605/4 "2017-03-08T03:00:12Z")
This in between state is not something we support.
---
### Author:  [@fortasse](https://meta.discourse.org/u/fortasse)
#### Post date: [March 8, 2017, 3:01am UTC](https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605/5 "2017-03-08T03:01:05Z")
Fair enough. We’ll find a work around.
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [March 8, 2017, 4:49am UTC](https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605/6 "2017-03-08T04:49:30Z")
A quick and easy solution would be to customize the template functions in wp-discourse so that avatars are not displayed on your website.
Look at the section ‘An example that removes the avatar image from the comments\_html template’ and ‘An example that removes the ‘participants’ section’:
[Customize the structure of WP Discourse templates](https://meta.discourse.org/t/wp-discourse-template-customization/50754)
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [May 10, 2019, 12:10pm UTC](https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605/7 "2019-05-10T12:10:42Z")
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [September 12, 2022, 12:59am UTC](https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605/8 "2022-09-12T00:59:57Z")
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [September 12, 2022, 10:36am UTC](https://meta.discourse.org/t/wordpress-plugin-receives-avatar-url-with-http-protocol-if-site-uses-https-and-no-cdn/58605/9 "2022-09-12T10:36:32Z")