diff --git a/plugins/webstats/lua/webstats_log.lua b/plugins/webstats/lua/webstats_log.lua
index aecc482a1..54af3199d 100644
--- a/plugins/webstats/lua/webstats_log.lua
+++ b/plugins/webstats/lua/webstats_log.lua
@@ -200,7 +200,8 @@ local function run_app()
         local request_uri = ngx.var.request_uri
         local body_length = C:get_length()
         local domain = host or "unknown"
-        local http_protocol = ngx.var.scheme or "http"
+        local forwarded_proto = ngx.var.http_x_forwarded_proto or ngx.var.http_x_forwarded_protocol or ngx.var.http_x_scheme or ""
+        local http_protocol = forwarded_proto ~= "" and string.lower(forwarded_proto) or (ngx.var.scheme or "http")
 
         local kv = {
             id = new_id,