Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

long time lurker - first time poster.

A client of mine has a website developed in CakePHP, and a wordpress blog installed in the /blog/ directory.

Let's say the url of the main domain is http://www.realdomain.com, with the blog being http://www.realdomain.com/blog/.

They don't have their own SSL certificate so they use my companies. Let's say the secure URL is https://realdomain.maindomain.net/blog/

I have the following code in my wp-config.php file:

define('WP_SITEURL', 'https://realdomain.maindomain.net/blog');
define('WP_CONTENT_URL', 'http://www.realdomain.com/blog/wp-content');
define('FORCE_SSL_LOGIN', true);
define('FORCE_SSL_ADMIN', true);

When I go to the /wp-login.php, it redirects me to the secure URL which is perfect.

However, when I log in to the secure site, WordPress tries to loads JavaScripts and styles from

`http**s**://realdomain.com`

Which causes problems because the main site doesn't have a SSL certificate and as a result doesn't load anything from https://realdomain.com

Is there anything else I'm missing?

Is the solution a .htaccess rule? A rule which routed all "https://realdomain.com" to "https://realdomain.maindomain.com"?

I'll pay anyone $20 who can help me fix it. I've Google'd until my hearts content and I don't know what else I can do.

Thanks so much!

share|improve this question
add comment

5 Answers

Just to keep things nice & clear, I've posted this as a new answer. Let's reset the playing field & follow the below instructions as if it were a shiny new install (ignore all code & suggestions in previous answers).

In your wp-config.php

define( 'WP_SITEURL', 'http://www.realdomain.com/blog' );
define( 'SSL_DOMAIN_ALIAS', 'realdomain.maindomain.net' );

define( 'FORCE_SSL_LOGIN', true );
define( 'FORCE_SSL_ADMIN', true );

And in wp-content/mu-plugins/ssl-domain-alias.php

<?php

/**
 * Plugin Name: SSL Domain Alias
 * Plugin URI: http://wordpress.stackexchange.com/questions/38902
 * Description: Use a different domain for serving your website over SSL, set with <code>SSL_DOMAIN_ALIAS</code> in your <code>wp-config.php</code>.
 * Author: TheDeadMedic
 * Author URI: http://wordpress.stackexchange.com/users/1685/thedeadmedic
 *
 * @package SSL_Domain_Alias
 */

/**
 * Swap out the current site domain with {@see SSL_DOMAIN_ALIAS} if the
 * protocol is HTTPS.
 *
 * This function is not bulletproof, and expects both {@see WP_SITEURL} and
 * {@see SSL_DOMAIN_ALIAS} to be defined.
 *
 * @todo The replacement is a simple string replacement (for speed). If the
 * domain name is matching other parts of the URL other than the host, we'll
 * need to switch to a more rigid regex.
 *
 * @param string $url
 * @return string
 */
function _use_ssl_domain_alias_for_https( $url )
{
    static $domain;
    if ( ! isset( $domain ) )
        $domain = defined( 'WP_SITEURL' ) && defined( 'SSL_DOMAIN_ALIAS' ) ? parse_url( WP_SITEURL, PHP_URL_HOST ) : false;

    if ( $domain && strpos( $url, 'https' ) === 0 )
        $url = str_replace( $domain, SSL_DOMAIN_ALIAS, $url );

    return $url;
}
add_filter( 'plugins_url', '_use_ssl_domain_alias_for_https', 1 );
add_filter( 'content_url', '_use_ssl_domain_alias_for_https', 1 );
add_filter( 'site_url', '_use_ssl_domain_alias_for_https', 1 );

?>

I've suggested using a Must-Use plugin (mu-plugins), since these are autoloaded without having to be activated first.

If you'd rather it be a standard plugin, you'll need to add the FORCE_SSL_* constants after activation.

share|improve this answer
    
Nice answer. I can not get this working with wordpress 3.3.2 and this two domains: myblog.tld && ssl.company.tld/myblog.tld. Do you have any suggestions? –  tonymarschall Apr 21 '12 at 18:43
    
I can confirm that this solution still works on Wordpress 3.5.1. Thank you. –  Jeff Strunk May 17 '13 at 16:10
add comment

I banged my head against the wall trying to move the admin functions on wordpress to a separate server. I thought I'd just add to it that having two host names does break the "preview" function in the editor, and so you need to modify your .htaccess to make that work again.

#special fixes on previews when wordpress sends user to the public blog & we want the hidden one.
RewriteCond %{HTTP_HOST} ^public.site.com$ [NC]
RewriteCond %{QUERY_STRING} .*(/?preview=true.*) [OR]
RewriteCond %{QUERY_STRING} (.*&preview=true.*) [NC]
RewriteRule ^(.*)$ http://secure.site.com/$1$2  [L,R=301]
share|improve this answer
add comment

WordPress will force HTTPS for all assets if the current protocol is SSL. I'm assuming realdomain.maindomain.net is an alias for realdomain.com?

If so, set your content URL to http://realdomain.maindomain.net/blog/wp-content.

All assets will be served from this URL, and automatically rewritten to HTTPS when required.

If (for whatever reason) you only ever want to serve content from the aliased domain inside the admin (i.e. via HTTPS), you can change the content URL conditionally:

define( 'WP_CONTENT_URL', 'http://www.realdomain.com/blog/wp-content' );

function use_alias_for_ssl( $url )
{
    if ( is_ssl() )
        $url = str_replace( 'www.realdomain.com', 'realdomain.maindomain.net', $url );
    return $url;
}
add_filter( 'content_url', 'use_alias_for_ssl' );
add_filter( 'plugins_url', 'use_alias_for_ssl' );

UPDATE: Try this, without any of the previous filters or additional defines;

/* wp-config.php */
define( 'WP_SITEURL', 'https://realdomain.maindomain.net/blog' );
define( 'FORCE_SSL_LOGIN', true );
define( 'FORCE_SSL_ADMIN', true );

/* wp-content/mu-plugins/any-filename.php */
add_filter( 'blog_option_siteurl', '_config_wp_siteurl' );
share|improve this answer
    
Thanks! Yes, realdomain.maindomain.net is an alias for realdomain.com I've added what you suggested to my wp-config.php file and the it still tries to get stuff from realdomain.com When you're on the wp-login.php, the form POSTs to https://realdomain.maindomain.net but once you've logged in, it gets some stuff from the right domain and then stuff from the wrong domain. i.imgur.com/pcIrO.png Here's an image of what's happening (ignore those <br>'s, just added them for spacing for you). The problem is /wp-admin/load-scripts.php and /wp-includes/ Other than that it works! –  Kingsley Jan 14 '12 at 18:04
    
Are you still defining WP_SITEURL? –  TheDeadMedic Jan 14 '12 at 19:59
    
define('WP_SITEURL', 'realdomain.maindomain.net/blog'); define('WP_CONTENT_URL', 'realdomain.com/blog/wp-content'); Yes mate, I used the above + the function you posted, tried it in the functions.php and wp-config and nothing –  Kingsley Jan 14 '12 at 21:22
    
Add add_filter( 'includes_url', 'use_alias_for_ssl' ); to the mix –  TheDeadMedic Jan 14 '12 at 21:43
    
Hi Pal, Added includes_url to the functions.php in my theme folder, it didn't have any effect. Just to confirm, in my wp-config.php, WP_SITEURL = secure version WP_CONTENTURL = normal version That's all the new stuff in the wp-config. In the functions.php The function in your first post followed by 3 add_filters.. Is that correct? The same thing is happening in the screenshot in my 2nd post. It's giving me a serious headache. I didn't think it would be this hard, and I think it's just me who is having the problem... I haven't read anything with a similar problem :( –  Kingsley Jan 14 '12 at 23:12
add comment

I updated the wp-config.php and WordPress MU isn't installed, so I created the mu-plugins folder in the /wp-content/ folder. A few things happened: When viewing the public side, it loaded certain files from https://realdomain.maindomain.net/blog and some from http://realdomain.com. Like this:

<script src="http://www.realdomain.com/blog/wp-content/plugins/commentluv/js/commentluv.js?ver=3.2.1" type="text/javascript">

<link href="https://realdomain.maindomain.net/blog/xmlrpc.php?rsd" title="RSD" type="application/rsd+xml" rel="EditURI">

<link href="https://realdomain.maindomain.net/blog/wp-includes/wlwmanifest.xml" type="application/wlwmanifest+xml" rel="wlwmanifest">

However, blog post URLs and thumbnails were linking correctly. It was just 4 files which were retrieved from the https:// site

On the wp-login page, the form URL was correct, https:// and it loaded the secure site.. However, I didn't change anything. It still pulls in 7 <script> & <link> files from https://realdomain.com.

The URLs on all the <forms> all POST to the correct https:// site..

Thanks for all your help so far, I really appreciate it!

share|improve this answer
add comment

Good morning buddy, I've done what you suggested. Updated the wp-config.php and placed that function in ssl-domain-alias.php and placed it in wp-content/mu-plugins (I always thought that was multi-user!).

Unfortunately it had no effect :( I manually typed in www.realdomain.com/blog/wp-login.php and it loaded perfectly, however it didn't force me to the https:// site. It loads everything from the normal non-https site.

I tried to enter in https://realdomain.maindomain.com/blog/wp-login.php and it forces me to login in https://realdomain.com. Once logged in, it pulls everything from the https://realdomain.com site. All the forms POST to the same https://realdomain.com site too.

I thought maybe it might be a .htaccess thing too, this is what I have in my .htaccess file to redirect all non-www. to www:

# redirect non www to www - revised from above to exclude https
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} .
RewriteCond %{HTTP_HOST} !^www\.realdomain\.com [NC]
RewriteRule (.*) http://www.realdomain.com/$1 [R=301,L]

I commented that out, tried it again and it had no effect.

I thought maybe it wasn't processing the the function, so I echoed "test" and it printed it, so I know that's working.

Maybe I should have mentioned it earlier, I'm using WordPress v3.2.1. I can't updated to version 3.3.1 because it requires a newer version of PHP and at the moment, we can't update.

I just don't know why I haven't been able to find anyone else with a similar problem.. I can't be the only one who has tried this? ..Right?

Thanks for all your hard work pally, I really do appreciate it!

share|improve this answer
    
Hmm, I've tried it on a local copy with success (admittedly 3.3.1, but shouldn't make any difference). Are the example domains identical to your actual domains, albeit with dummy names (i.e. in terms of format)? –  TheDeadMedic Jan 18 '12 at 21:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.