I have a wordpress installation on my virtual host, where the document root is accessible as both "somesite.com" as well as "www.somesite.com". If I set up site_url as "http://somesite.com", then when I access "www.somesite.com" then wordpress thinks I am not logged in (and I can't see private posts and such), while if I set site_url to "http://www.somesite.com", then the same problem happens with "somesite.com".

I would really like both variations to be acceptable.

  • Typically one of the two domains is chosen as the real domain with the other silently redirecting from the server. Also, all the links on the public side will be to the domain in site_url. Dec 9 '13 at 1:53
  • The setup you suggest is a bit more complicated then what I can afford now, considering that this problem only affects registered users you aren't paying attention (probably about 2 of my users). I'd still like to get down to the reason for this and solve it properly and not heavy handedly.
    – Guss
    Dec 9 '13 at 12:09
  • If you are on Apache, then it takes 2 minutes to add it to your .httaccess file. Dec 9 '13 at 15:13
  • Actually, I just remembered you don't have to do that as WordPress enforces this by itself. It is known as the canonical URLs. WordPress by default will redirect to the domain name set in the settings if the current domain is another. Dec 9 '13 at 15:35
  • 1
    My set up is a little different then a straight up Wordpress install, and so Wordpress doesn't do that redirect (nor do I want it to). If there is no other option, I'll see if I can write this myself.
    – Guss
    Dec 9 '13 at 21:17

While www and non-www versions of site are considered kind of same thing from user perspective, technically they are two completely different domains, possibly hosting completely different sites on different servers.

Since cookies are domain-specific WP treats them accordingly.

It's not impossible to rework this, since cookie-related functions seem to mostly be pluggable, but really the most common and practical solution is to have canonical version and have other redirect to it.

  • its interesting that you say that, because according to Firefox's developer console, Firefox sends the PHP session cookie as well as the wordpress cookies for both the www and non-www versions, so it can't be only cookie based.
    – Guss
    Dec 8 '13 at 22:44
  • Do you have any images or other media coming from the other domain? If so, the cookie will be sent to those. But the cookie by spec will not be sent to a domain it is not for. So, not sure what you are seeing, but Firefox should not be sending the cookie per the security spec. Dec 9 '13 at 1:48
  • See RFC6265# For example, if the value of the Domain attribute is "example.com", the user agent will include the cookie in the Cookie header when making HTTP requests to example.com, www.example.com, and www.corp.example.com . So Firefox appears to behave according to the specification.
    – Guss
    Dec 9 '13 at 12:07
  • Yes, but cookies being available doesn't mean WP does (or should) check them for all sub domains. As above - they might be completely different installs.
    – Rarst
    Dec 9 '13 at 16:22
  • I'm not sure why you say that - Wordpress is being called and should read the cookies it was sent. If the cookie is from a different install, then it won't much the stored session IDs, right? Regardless - the cookies in my setup are completely valid, but Wordpress ignores them anyway. I want to understand why, and how to fix it.
    – Guss
    Dec 9 '13 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.