We have several environments and we have just started using wordpress (Dev, QA, Pre-prod, prod etc...). We don't have https enabled in the lower environments and everything is working smoothly. In our prod environments the site redirects all traffic to https.

The first issue seems to only be with chrome. Chrome refuses to load anything on the page that isn't https. I am unsure how to get WordPress to load jquery or styles.css (from my theme) over https ( more information below).

The second issue also with HTTPS is we cannot log into wordpress in the environments that use HTTPS. When the login screen loads (sitename.com/wp-admin) you get redirected to wp-login as expected but upon entering your username / password the page just refreshes. No errors (checked console / firebug and httpfox and couldn't find any errors).

I know we are doing something wrong with https in general because we are having many problems in the environments that support it. I have done a bunch of googling and haven't really come up with much on using HTTPS and wordpress surprisingly. Aside from answers to the questions of how to load jquery via HTTPS and how can we log into the https wordpress instances, are there any good links on how to work with HTTPS in wordpress. Almost everything I have found points to using the plugin WordPress HTTPS and we are going to try that but I am not sure if it will solve all of our issues.

Note* In my functions.php I am using Enqueue to load JS and CSS files the proper way, and I am using relative pathing on those loads //sitename.com/bla/bla which works fine. I am loading jquery using: in my header.php and styles.css is loaded automatically as part of my theme loading using , so I don't know how to configure either to load via HTTPS or if that is even the correct approach to fixing these issues. (jQuery is loading from our local file system not a CDN). Any help would be greatly appreciated. Thanks in advance.

  • Is your production site behind a reverse proxy / load balancer? That will stop WordPress detecting SSL, and no scripts will load via SSL. If unsure, install SSL Insecure Content Fixer and run the is_ssl() test from the plugins page.
    – webaware
    Jul 3, 2013 at 0:24
  • Our site is behind a load balancer for sure. I have previously worked on a WP site behind a load balancer with HTTPS enabled and did not have these issues (but I had some network people who were excellent who probably took care of these issues for me). So what can we do to get WordPress to detect SSL behind the load balancer.
    – RAC
    Jul 3, 2013 at 17:56
  • I am also unable to load plugins in these problem environments because I CAN'T LOG IN TO WORDPRESS. So sadly all fixes that involve loading a plugin aren't going to help.
    – RAC
    Jul 3, 2013 at 18:03

4 Answers 4


Since you are behind a load balancer (confirmed in your comments above), your WordPress installation won't be able to detect SSL using the is_ssl() function, and will not serve any enqueued scripts or stylesheets with https: protocol URIs.

If you are behind a load balancer that supports the HTTP_X_FORWARDED_PROTO server variable, you can fix your problem by adding this snippet to your wp-config.php file:

// Amazon AWS Elastic Load Balancer, CloudFlare, and some others

If you're unlucky enough to be hosted on Network Solutions, first beat your head against a desk, then try to work this gist into an already-activated plugin (since you can't activate new plugins because you can't login to admin): https://gist.github.com/webaware/4688802

Actually, you should be able to force your admin to not use SSL, login, install whatever plugins you need, and then test your installation over SSL to see if all is working, before forcing it to use SSL. Add this to your wp-config.php file, changing WP_SITEURL and WP_HOME to match your real server.

define('FORCE_SSL_LOGIN', false);
define('FORCE_SSL_ADMIN', false);
define('WP_SITEURL', 'http://example.com/');
define('WP_HOME', 'http://example.com/');
  • Thanks for this! I'm kind of surprised this isn't built-in by default.
    – Noz
    Nov 23, 2015 at 18:41
  • Thanks for this answer! The wp-config.php update works well when I set up HTTPS using AWS ELB.
    – Leon
    Aug 10, 2018 at 5:09

Most SSL issues are due to plugins/themes using the wrong code to load CSS/JS.

  • Under WordPress General Settings change the WordPress Address (URL) and the Site Address (URL) from HTTP to HTTPS. If you don't have access to your admin you can change this via your wp-config.php http://codex.wordpress.org/Editing_wp-config.php

  • Use the proper url paths for your themes and plugins: http://codex.wordpress.org/Determining_Plugin_and_Content_Directories for example hardcoding the WP_PLUGIN_URL will not work as opposed to plugin_dir_url. The functions are generally SSL friendly because they have time to check if the site is SSL enabled, the constants are not.

  • For the admin/login you can force SSL via the wp-config.php:

    Login: define('FORCE_SSL_LOGIN', true);

    Admin: define('FORCE_SSL_ADMIN', true);

Of course any hardcoded assets will be a problem or plugins/themes that incorrectly load assets.

You can also update your themes and plugins via SSL if your server has libssh2 , you can also define the port# and Auth keys. If this is enabled you do not have to define anything it will just magically show up in the admin settings.

  • Thanks for the reply. I built the plugins we use and they all load css js the correct way. My first question remains unanswered though. WordPress is loadings jquery and styles.css on my homepage and it is doing so via HTTP. Chrome is blocking both these essential loads. Is there a way to force wordpress to load assets in https?
    – RAC
    Jul 2, 2013 at 16:39
  • Also you mentioned libssh2. Where is this configured. Is searched apaches httpd.conf for it with no results. Is it a php module?
    – RAC
    Jul 2, 2013 at 16:58
  • libssh2 is a ssh library for your OS, so you would install it at the OS level, then PHP can use it using something like pecl.php.net/package/ssh2 which is a PHP extension. Did you do step #1? If so then no assets should load via HTTP unless it's from a theme or plugin doing it wrong.
    – Wyck
    Jul 2, 2013 at 18:14
  • I can't do step one before I can't log into wordpress.
    – RAC
    Jul 2, 2013 at 21:52
  • You can define this setting in your wp-config.php file, codex.wordpress.org/…
    – Wyck
    Jul 3, 2013 at 0:00

Ok! It happened to me like that before. Make sure that you load your jquery file properly and then double check the plugins depended javascript file. WordPress has some ways to load js file. Again to check not to load default wordpress jquery file and your custom jquery version file. For Your HTTP Problem, please read html5boilerplate.com they use smarter ways for HTTP. Don't too much hack the core file :)

  • I have already tried disabling all of the plugins via database (since I can't log into wordpress's admin panel I can't edit anything accept file system stuff or DB stuff, nothing in the wordpress UI).
    – RAC
    Jul 2, 2013 at 21:54

We found a solution and it appears to be purely environmental as in a problem in how our environments were setup. As it happens, our MySQL server and our actual server were not on the same box and wordpress needs to explicitly know the difference between request routed to the MySQL box and the box containing the actual code. So the fix lied in figuring out what Database entries to point at the SQL and which to point at the web server.

Once we figured out how to setup the environments so that I could log in I enabled the HTTPS plugin and we were able to load the site normally fixing the chrome issue of blocked non http requests.

  • Threads are not closed around here, you should just choose an answer.
    – Wyck
    Jul 9, 2013 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.