Control panel switches to HTTPS protocol on its own On one Craft CMS site I have, all control panel URLs I call over HTTP are rewritten to HTTPS. E.g. the login page, as well as all its assets, are being served via https://www.mywebsite.com/admin/….

The rest of the site is available via https://www.mywebsite.com/

I've already tried to enforce HTTP via mod.rewrite in .htaccess, as well as explicitly setting baseCpUrl and an new cpTrigger in config/general – with no success at all.

Is this a feature that I can deactivate? A bug in Craft CMS 2.4.2670?
Or is this a server-side issue?
It turned out not to be Craft's fault, indeed: 

On the server, the HTTP_X_FORWARDED_PROTO environment variable was erroneously set to https in the reverse proxy – an issue that my hosting provider had to resolve.

(As a quick fix, the following line in index.php did the trick, too:)

 apache_setenv('HTTP_X_FORWARDED_PROTO', 'http');


Thanks to @brad-bell and @ritterknight for pointing in the right direction!