I have a multisite setup, using SSL.

Everything works fine. visitors are getting all there content over https. There is not a single url without httpS in my page source. (inclusing urls to css,js files)

But, once go to the login page, all my css files have an URL with http instead of https. So most browsers block these insecure sources, thus screwing up admin interface. The pages itself is loaded over https, all redirects are also served over https.

My site url is set to https://... I'v searched my database and project files and there is not a single reference to http://...

What can cause this problem?

  • By "all my CSS files" do you mean all your custom CSS files, or all the standard ones too? Are you running any SSL fixer plugins to fix the front end, or is it "just working"? Can you supply a link to the website? – webaware Dec 25 '13 at 21:24
  • On the front-end all my scripts and stylesheets are over https. Standard and custom ones. There is not a single occurrence off "http://" in the page source. Once you'r on the login page, the standard css files are over http:// . For example: xyz.xy/wp-admin/css/wp-admin.min.css?ver=3.5.1 Sorry, I can't provide a link. I even can't reach the server when I'm not on my clients office. – user63457 Dec 27 '13 at 10:08
  • Asking again: Are you running any SSL fixer plugins to fix the front end, or is it "just working"? I dropped wp3.5.1 into a test site and it loads its CSS over SSL on the login page, so either you have a fix for the front end or you have something else broken there. – webaware Dec 27 '13 at 23:26
  • No "SSL fixer" plugins are used. The SSL was enabled by a server-admin. They do use a plugin called "Better WP security". I see it tries to force certain pages over SSL. I will try disabling this plugin to see what it actually does. Sadly, the office is closed for the holidays, so I can't report back until next week. – user63457 Dec 29 '13 at 12:20
  • I'v disabled the "Better WP securty" plugin, the problem persists. I've started with a clean .htaccess file but still no luck. The login page over https is displayed with css over http. I'v tried setting FORCE_SSL_ADMIN to true, but then I get a page not found error. – user63457 Jan 23 '14 at 12:33

Got it solved. Turns out the server was hosted behind a reversed proxy, causing WordPress not knowing it was running over https.

Once I knew this, I found the solutions in the official documentation: http://codex.wordpress.org/Administration_Over_SSL (under "Using a Reverse Proxy")

This was needed in my wp-config.

define('FORCE_SSL_ADMIN', true);
if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
$_SERVER['HTTPS']='on'

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.