After a few more days of frustrating testing, I managed to track the issue down to the External Links Rewrite option in Siteground’s Site Tools, under SSL options. When HTTP Enforce is enabled with the optional External Links Rewrite option (being able to see these changes virtually immediately in the browser requires a Force Refresh, which was what has made testing this stuff so hard) the icons in Visual Editor go missing. When External Links Rewrite is turned off, the icons show up again.
I’ve contacted Siteground’s customer support for a solution, but so far they claim they’ve been unable to reproduce the issue, despite the fact I’ve so far managed to reproduce it on both of the two systems I have access to: Firefox and Chrome running on Windows 7, and Firefox running on MacOS High Sierra.
UPDATE:
Within 6 hours of filing the ticket, Siteground support finally escalated it to a more senior technical person, who then gave me the following response:
This response confirms what I’d suspected: that the “External Links Rewrite” option in Siteground’s control panel (which they call Site Tools) is broken. They also claim that the team were already aware of the issue, although I’m skeptical of this given that it took a few responses for the initial support to escalate the ticket and the fact that the new React-based (and admittedly very good) Site Tools interface seems to have been launched just a few weeks ago.
In any case, Siteground insist a fix is on the way, and that in the meantime the solution is to disable HTTPS enforcement from the Site Tools panel entirely, and instead download its SG Optimiser plugin, enabling HTTPS Enforce and External Links Rewrite from there. I’ve tested this solution and can confirm that it solves the issue.
I inspected my .htaccess file after enabling these options with SG Optimiser, and it seemed to me that the only thing it was adding was the following Apache directive:
# HTTPS forced by SG-Optimizer
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
</IfModule>
# END HTTPS
As someone who tries his best to run a bare-minimum installation with only the most necessary plugins, writing code for everything else, I wondered if this was the only thing SG Optimiser was doing to force HTTPS, and if I could replace it by simply adding the same directives to .htaccess myself.
However, on further inquiry from Siteground support, this doesn’t seem to be the case:
Now, the only thing left to do is to wait for Siteground to fix this bug in the new Site Tools interface, after which I’ll finally be able to remove the unnecessary SG Optimiser plugin and enforce HTTPS from the control panel itself.