i would be thankful if someone can explain the following code, from wp-login.php (the first few lines of the file):

 // Redirect to https login if forced to use SSL
    if ( force_ssl_admin() && ! is_ssl() ) {
        if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
            wp_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
        } else {
            wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

As far as I know, the $_SERVER[RQUEST_URI] can only contain absolute paths, like /wordpress/mapage/?foo=bar. Why is it checked on a protocoll/scheme?

And why are there two cases (false/true) what, do they do exactly. Espeically the first one. The second one is the same, I would have written the function using https + Host + URI


1 Answer 1


This part of code was introduced as whole block, together with a bunch of other stuff, quite a few years ago. See changeset 8069 in trac.

While there is no clear mention in PHP docs, apparently in specific configurations the value might be a full URL with protocol. See for example $_SERVER['REQUEST_URI'] returns full URL instead of path to script question on Stack Overflow.

The two cases are because the code to form secure URL is different, conditional on that possible difference in input.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.