2

I have a multisite setup, using SSL.

Everything works fine. visitors are getting all there content over https. There is not a single url without httpS in my page source. (inclusing urls to css,js files)

But, once go to the login page, all my css files have an URL with http instead of https. So most browsers block these insecure sources, thus screwing up admin interface. The pages itself is loaded over https, all redirects are also served over https.

My site url is set to https://... I'v searched my database and project files and there is not a single reference to http://...

What can cause this problem?

Improve this question
6
  • By "all my CSS files" do you mean all your custom CSS files, or all the standard ones too? Are you running any SSL fixer plugins to fix the front end, or is it "just working"? Can you supply a link to the website?
    – webaware
    Dec 25, 2013 at 21:24
  • On the front-end all my scripts and stylesheets are over https. Standard and custom ones. There is not a single occurrence off "http://" in the page source. Once you'r on the login page, the standard css files are over http:// . For example: xyz.xy/wp-admin/css/wp-admin.min.css?ver=3.5.1 Sorry, I can't provide a link. I even can't reach the server when I'm not on my clients office.
    – user63457
    Dec 27, 2013 at 10:08
  • Asking again: Are you running any SSL fixer plugins to fix the front end, or is it "just working"? I dropped wp3.5.1 into a test site and it loads its CSS over SSL on the login page, so either you have a fix for the front end or you have something else broken there.
    – webaware
    Dec 27, 2013 at 23:26
  • No "SSL fixer" plugins are used. The SSL was enabled by a server-admin. They do use a plugin called "Better WP security". I see it tries to force certain pages over SSL. I will try disabling this plugin to see what it actually does. Sadly, the office is closed for the holidays, so I can't report back until next week.
    – user63457
    Dec 29, 2013 at 12:20
  • I'v disabled the "Better WP securty" plugin, the problem persists. I've started with a clean .htaccess file but still no luck. The login page over https is displayed with css over http. I'v tried setting FORCE_SSL_ADMIN to true, but then I get a page not found error.
    – user63457
    Jan 23, 2014 at 12:33

1 Answer 1

Reset to default
4

Got it solved. Turns out the server was hosted behind a reversed proxy, causing WordPress not knowing it was running over https.

Once I knew this, I found the solutions in the official documentation: http://codex.wordpress.org/Administration_Over_SSL (under "Using a Reverse Proxy")

This was needed in my wp-config. 

define('FORCE_SSL_ADMIN', true);
if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
$_SERVER['HTTPS']='on'
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.