Magento – How Do I Get Secure Image URLs in Magento

Your first attempt (with the {{media}} tag) is correct and should work.

In the admin go to System > Configuration > Web > Secure and make sure the following are set:

• Base Link URL - {{secure_base_url}}
• Base Skin URL - {{secure_base_url}}skin/
• Base Media URL - {{secure_base_url}}media/
• Base Javascript URL - {{secure_base_url}}js/

This way all the paths generated will follow the protocol given in "Base URL". If a page is secure everything on it will also be served secure.

Alternatively, just leave out the protocol and colon in URLs and the browser will choose the right one automatically. AFAIK this works with all browsers even when linking to external sites.

<img src="//mywebsite.com/media/wysiwyg/infortis/ultimo/menu/featured2.jpg" />

If you need to force either a secure or unsecure URL directly then there is the "config" tag instead. This should end with a forward slash because the config value should also end with a slash. Write your path immediately after this.

{{config path="web/secure/base_media_url"}}wysiwyg/infortis/ultimo/menu/featured2.jpg

If you have upgraded to Magento 1.9.2.2 or applied the latest patch then you need to whitelist the paths you use in {{config}} directives. To do so, enter them in system > permissions > variable permissions.

The redirect to HTTPS root has nothing to do with the unsafe URL setting and the .htaccess setting suggested is not required.

If you have issues when redirecting from http://yoursite.com/your_product.html to https://yoursite.com/ when using HTTPS, just go to:

System -> Configuration -> General -> Web -> Redirect options

And set:

Auto-redirect to Base URL -> No

If you need to fix broken URLs from broken addons/styles by changing href="http://somewhere... or src="http://somewhere..." into href="//somewhere... and src="//somewhere..." as usual to prevent mixed content issues. Of course, all external services should support HTTPS, but keep in mind the slowdown of having external resources.