Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm using Wordpress in a NginX server proxying to an apache server which serves the pages. Recently we wanted to force the use of SSL at least in the Admin section, so we installed the Wordpress HTTPS plugin. The server sections in NginX are properly configured, but when I activate the "Force SSL for admin" option I fall on a redirect loop.

I don't think that it's a cookie issue. If you need more info, I'll pass it to you.

share|improve this question
add comment

2 Answers

I recently struggled with a similar issue, so I'll offer a couple of additional pieces of information for people who search for this question.

  1. The first step you should take when trying to force SSL for Admin of your site is to follow the directions in the codex . This means defining the FORCE_SSL_ADMIN option in your wp-config.php file.
  2. Be sure to take note of the warning in the codex that this edit needs to be above the /* That's all, stop editing! Happy blogging. */ line.
  3. There are many possible reasons why this could give you a redirect loop, but they all boil down the fact that Wordpress' is_ssl() function is returning false. For example, you may be running behind a reverse proxy that is doing SSL offloading. If that's the case, then your users enter https://yourwordpresssite, but the SSL offloader handles the decryption and by the time your server receives the request, the request is no longer SSL, and your server sees http://yourwordpresssite. If you're stuck here, again the codex has good advice, assuming your reverse proxy is properly configured. See the instructions here: (http://codex.wordpress.org/Administration_Over_SSL#Using_a_Reverse_Proxy).

If that still doesn't work, then your reverse proxy may not be setting the HTTP_X_FORWARDED_PROTO header. Unfortunately, none of this stuff is standardized, and there's more than one way to indicate that SSL offloading has taken place. The way used by our load balancer (Citrix Netscaler) is with the header Microsoft created called Front-End-Https. You can see this header as one of the common non-standard response headers listed on wikipedia here: (http://en.wikipedia.org/wiki/List_of_HTTP_header_fields#Common_non-standard_response_headers). Note that by the time your server sees this header, it will look like HTTP_FRONT_END_HTTPS. Note also that Netscaler doesn't send this header by default -- you have to configure it to add the header. This is documented here, and there's a nice video demo of how to do it here.

In the end, because we're doing our entire site with HTTPS only, I elected to use the wordpress-https plugin, which does a good job of handling edge cases (like other wordpress plugins that have hard coded http:// URLs that will cause warnings on your secure pages). I patched the plugin to recognize the HTTP_FRONT_END_HTTPS header and am submitting a patch to the author, so at some point this should be support by that plugin.

Good luck!

share|improve this answer
1  
I created a test page with print_r($_SERVER); to see what HTTPS variables were set. I found both HTTPS and HTTP_X_FORWARDED_PROTO were not set properly, so I fixed that in NGINX and no more redirect loop! –  Justin Oct 2 '13 at 22:38
add comment

The check for is_ssl() is not really the best in WP. You can take this mu-plugin to get a better check. Then simply stick tight to the recommendations of the codex.

Ad the Wordpress HTTPS-Plugin) I wouldn't count too much on this plugin when I look at trunk...

Mu-Plugins

MU-Plugins in Codex

share|improve this answer
    
So... should I take the is_ssl.php file and install it where? –  Injeniero Barsa Mar 15 '12 at 18:04
    
just drop it into your mu-plugins folder. It's activated automagically. You can then use the provided template tags (see bottom of the file) everywhere. –  kaiser Mar 15 '12 at 18:24
    
I don't have a folder called like that in my WP installation. –  Injeniero Barsa Mar 15 '12 at 19:02
    
Just add it in your wp-content folder. –  kaiser Mar 15 '12 at 20:02
    
Nope. Still doesn't work :( –  Injeniero Barsa Mar 16 '12 at 14:49
show 6 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.