FORCE_SSL_ADMIN affecting subdomains

Question

I have a Wordpress installation in the root directory of my host. It includes an SSL certificate for that primary domain (e.g. domain.com; not a wildcard certificate).

When I include define('FORCE_SSL_ADMIN', true); in wp-config.php, suddenly all subdomains also try to redirect to https, despite the fact that there is no SSL certificate for those subdomains.

Some of the subdomains are also Wordpress installs in subfolders of my host (e.g. test.domain.com), but others are hosted on completely separate hosts.

When I look at chrome://net-internals/#hsts I see:

static_sts_domain: 
static_upgrade_mode: UNKNOWN
static_sts_include_subdomains: 
static_sts_observed: 
static_pkp_domain: 
static_pkp_include_subdomains: 
static_pkp_observed: 
static_spki_hashes: 
dynamic_sts_domain: domain.com
dynamic_upgrade_mode: STRICT
dynamic_sts_include_subdomains: true
dynamic_sts_observed: 1477318558.379693
dynamic_pkp_domain: 
dynamic_pkp_include_subdomains: 
dynamic_pkp_observed: 
dynamic_spki_hashes:  

Why would FORCE_SSL_ADMIN affect dynamic_sts_include_subdomains? Is there any way around this, while still keeping adequate security in my WP Admin?

Answer 1

It turns out that the shared server I have at Network Solutions is forcing HSTS through their service. And since it's a shared hosting server, they refuse to change it.

The solution: I purchased a Wildcard certificate, and installed it on multiple servers for each subdomain.

Answer 2

It sounds like you're using WordPress Multisite which means all your domains share the same wp-config.php.

If this is the case, you can limit SSL to only that one domain by wrapping an if statement around the define( 'FORCE_SSL_ADMIN', true ).

NOTE: Make sure to change the domain.com to whatever your true SSL website domain name is.

if ( 'domain.com' == $_SERVER['HTTP_HOST'] ) {
  define( 'FORCE_SSL_ADMIN', true );
}