diff --git a/civicrm/CRM/Contribute/Form/ContributionPage/Widget.php b/civicrm/CRM/Contribute/Form/ContributionPage/Widget.php
index 2a88bc06b5dfee0c1d228ba7512d6175c354a141..9d08453b0c008efe76ea934f9e325caf1f5a970e 100644
--- a/civicrm/CRM/Contribute/Form/ContributionPage/Widget.php
+++ b/civicrm/CRM/Contribute/Form/ContributionPage/Widget.php
@@ -55,6 +55,8 @@ class CRM_Contribute_Form_ContributionPage_Widget extends CRM_Contribute_Form_Co
 
     $this->assign('cpageId', $this->_id);
 
+    $this->assign('widgetExternUrl', CRM_Utils_System::externUrl('extern/widget', "cpageId={$this->_id}&widgetId={$this->_widget->id}&format=3"));
+
     $config = CRM_Core_Config::singleton();
     $title = CRM_Core_DAO::getFieldValue('CRM_Contribute_DAO_ContributionPage',
       $this->_id,
diff --git a/civicrm/CRM/Core/Payment/PaymentExpress.php b/civicrm/CRM/Core/Payment/PaymentExpress.php
index 28552293feeda9e863a2fb44186cb8904f034b8e..47db6a690ca1fa4072ea3889d0619ee9b5139602 100644
--- a/civicrm/CRM/Core/Payment/PaymentExpress.php
+++ b/civicrm/CRM/Core/Payment/PaymentExpress.php
@@ -121,7 +121,7 @@ class CRM_Core_Payment_PaymentExpress extends CRM_Core_Payment {
       CRM_Core_Error::fatal(ts('Component is invalid'));
     }
 
-    $url = $config->userFrameworkResourceURL . "extern/pxIPN.php";
+    $url = CRM_Utils_System::externUrl('extern/pxIPN');
 
     if ($component == 'event') {
       $cancelURL = CRM_Utils_System::url('civicrm/event/register',
diff --git a/civicrm/CRM/Cxn/BAO/Cxn.php b/civicrm/CRM/Cxn/BAO/Cxn.php
index 658bd61fc6e83afe1ce516e6d9ed46bd0f7ae0e1..e304c99b3278aa2b7109a3d4c1ac97e409c1ca4b 100644
--- a/civicrm/CRM/Cxn/BAO/Cxn.php
+++ b/civicrm/CRM/Cxn/BAO/Cxn.php
@@ -45,22 +45,7 @@ class CRM_Cxn_BAO_Cxn extends CRM_Cxn_DAO_Cxn {
    * @return string
    */
   public static function getSiteCallbackUrl() {
-    $config = CRM_Core_Config::singleton();
-
-    if (preg_match('/^(http|https):/', $config->resourceBase)) {
-      $civiUrl = $config->resourceBase;
-    }
-    else {
-      $civiUrl = rtrim(CRM_Utils_System::baseURL(), '/') . '/' . ltrim($config->resourceBase, '/');
-    }
-
-    // In practice, this may not be necessary, but we want to prevent
-    // edge-cases that downgrade security-level below system policy.
-    if (Civi::settings()->get('enableSSL')) {
-      $civiUrl = preg_replace('/^http:/', 'https:', $civiUrl);
-    }
-
-    return rtrim($civiUrl, '/') . '/extern/cxn.php';
+    return CRM_Utils_System::externUrl('extern/cxn', NULL, NULL, TRUE, TRUE);
   }
 
   /**
diff --git a/civicrm/CRM/Mailing/BAO/Mailing.php b/civicrm/CRM/Mailing/BAO/Mailing.php
index 1223735d80477230ba3ab6be062ac4b96d362657..ccb7ce99a644839aeeb2bd8e704c728705a38417 100644
--- a/civicrm/CRM/Mailing/BAO/Mailing.php
+++ b/civicrm/CRM/Mailing/BAO/Mailing.php
@@ -1163,8 +1163,8 @@ ORDER BY   civicrm_email.is_bulkmail DESC
 
     // push the tracking url on to the html email if necessary
     if ($this->open_tracking && $html) {
-      array_push($html, "\n" . '<img src="' . $config->userFrameworkResourceURL .
-        "extern/open.php?q=$event_queue_id\" width='1' height='1' alt='' border='0'>"
+      array_push($html, "\n" . '<img src="' . CRM_Utils_System::externUrl('extern/open', "q=$event_queue_id")
+        . '" width="1" height="1" alt="" border="0">'
       );
     }
 
diff --git a/civicrm/CRM/Mailing/BAO/TrackableURL.php b/civicrm/CRM/Mailing/BAO/TrackableURL.php
index da57a134c3eb8674234aa1318cc8dc01a9c8cd4d..87d02927797c29c68c4c5ff901018c54e6f75511 100644
--- a/civicrm/CRM/Mailing/BAO/TrackableURL.php
+++ b/civicrm/CRM/Mailing/BAO/TrackableURL.php
@@ -93,7 +93,7 @@ class CRM_Mailing_BAO_TrackableURL extends CRM_Mailing_DAO_TrackableURL {
       $urlCache[$mailing_id . $url] = $redirect;
     }
 
-    $returnUrl = "{$urlCache[$mailing_id . $url]}&qid={$queue_id}";
+    $returnUrl = CRM_Utils_System::externUrl('extern/url', "u=$id&qid=$queue_id");
 
     if ($hrefExists) {
       $returnUrl = "href='{$returnUrl}' rel='nofollow'";
diff --git a/civicrm/CRM/Utils/System.php b/civicrm/CRM/Utils/System.php
index b52932368805f2c7f3579531484d4921059661bf..cdb6ffbd3f8a8899fdd8242c4fd7a3dd1fe387c0 100644
--- a/civicrm/CRM/Utils/System.php
+++ b/civicrm/CRM/Utils/System.php
@@ -300,6 +300,41 @@ class CRM_Utils_System {
     return $url;
   }
 
+  /**
+   * Generates an extern url.
+   *
+   * @param string $path
+   *   The extern path, such as "extern/url".
+   * @param string $query
+   *   A query string to append to the link.
+   * @param string $fragment
+   *   A fragment identifier (named anchor) to append to the link.
+   * @param bool $absolute
+   *   Whether to force the output to be an absolute link (beginning with a
+   *   URI-scheme such as 'http:').
+   * @param bool $isSSL
+   *   NULL to autodetect. TRUE to force to SSL.
+   */
+  public static function externUrl($path = NULL, $query = NULL, $fragment = NULL, $absolute = TRUE, $isSSL = NULL) {
+    $query = self::makeQueryString($query);
+
+    $url = Civi::paths()->getUrl("[civicrm.root]/{$path}.php", $absolute ? 'absolute' : 'relative', $isSSL)
+      . ($query ? "?$query" : "")
+      . ($fragment ? "#$fragment" : "");
+
+    $parsedUrl = CRM_Utils_Url::parseUrl($url);
+    $event = \Civi\Core\Event\GenericHookEvent::create([
+      'url' => &$parsedUrl,
+      'path' => $path,
+      'query' => $query,
+      'fragment' => $fragment,
+      'absolute' => $absolute,
+      'isSSL' => $isSSL,
+    ]);
+    Civi::service('dispatcher')->dispatch('hook_civicrm_alterExternUrl', $event);
+    return CRM_Utils_Url::unparseUrl($event->url);
+  }
+
   /**
    * Path of the current page e.g. 'civicrm/contact/view'
    *
diff --git a/civicrm/templates/CRM/Contribute/Page/Widget.tpl b/civicrm/templates/CRM/Contribute/Page/Widget.tpl
index 1074e2e1a71f9f0f59f67742f33f8ee07c09e718..125d07d34029f9be19ce44b4a1e82f2646598969 100644
--- a/civicrm/templates/CRM/Contribute/Page/Widget.tpl
+++ b/civicrm/templates/CRM/Contribute/Page/Widget.tpl
@@ -211,4 +211,4 @@ function onReady( ) {
 }
 </script>
 {/literal}
-<script type="text/javascript" src="{$config->userFrameworkResourceURL}/extern/widget.php?cpageId={$cpageId}&widgetId={$widget_id}&format=3"></script>
+<script type="text/javascript" src="{$widgetExternUrl}"></script>