I am using nginx as my webserver and i have edited the configuration file to point to https, so i change the WordPress url settings to https and also added the WordPress force ssl admin code to my wp-config file but I keep running into the error "This webpage has a redirect loop"
9 Answers
You've added $_SERVER['HTTPS'] = 'on';
to your wp-config.php?
You should also use the WP Migrate DB plugin to migrate from http://yoursite.com
to https://yoursite.com
-
12
-
6
-
5Thank you! That probably saved me a few more hours of trying to figure out why the admin area wasn't working with SSL. Feb 20, 2016 at 17:42
-
4
-
2Why does this work? I already used Interconnect's S&R tool. I should already have the right protocol in the database.– JeffFeb 15, 2017 at 20:28
I had a similar problem and just added the following snippet to my wp-config.php
:
/** SSL */
define('FORCE_SSL_ADMIN', true);
// in some setups HTTP_X_FORWARDED_PROTO might contain
// a comma-separated list e.g. http,https
// so check for https existence
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)
$_SERVER['HTTPS']='on';
as suggested in the Codex. This will only be needed in case there's SSL passthrough enabled in your load balancer (or firewall) setup. Meaning that while you can access the site via HTTP within TLS/SSL, the communication that your server receives is HTTP only. To account for that, above header is needed so WordPress can "set" HTTPS to on
in the $_SERVER
config array.
-
2This is great solution specifically for anyone using a load balancer. I was hosting this using Dokku (a host-it-yourself clone of Heroku) and having problems with static resource loading and the wp-admin redirect loop. Dokku also does an nginx reverse proxy to forward incoming 443 traffic to port 80 and this fixes the issue.– ZachMJun 6, 2016 at 14:54
-
3I had to just put the
$_SERVER['HTTPS'] = 'on';
because HTTP_X_FORWARDED_PROTO is not even in the settings on my client's server :| Jan 23, 2017 at 17:11 -
1
-
This also fixed the "Too many redirect issue" as my site is behind a load balancer on AWS.– voamNov 1, 2017 at 19:24
-
I think is important to add to this answer the fix for the .htaccess file for such cases: stackoverflow.com/questions/36748110/…, check @harshal-lonare answer. Oct 5, 2018 at 15:29
As I do not have the comment privilege yet, I will post this addition as another answer:
The solution proposed by Elias, to add the following to wp-config.php
, did the trick for me:
/** SSL */
define('FORCE_SSL_ADMIN', true);
// in some setups HTTP_X_FORWARDED_PROTO might contain
// a comma-separated list e.g. http,https
// so check for https existence
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)
$_SERVER['HTTPS']='on';
However, it only worked for me when I put it before everything else in this file!
-
1This was exactly what my problem was. I had put these at the end of the file and it wasn't working. I was ready to rebuild my site from scratch. Moved them to the top and bam, issue fixed. Thank you, Thank you!! Feb 3, 2018 at 2:19
-
1This solution is great if you're using a flexible SSL behind a proxy DNS like Cloudflare. Thank you.– Stefan PFeb 16, 2018 at 5:44
-
Confirmed working. Thank you so much, this fixes a lot of problems we had with API's and IFrames. The site doesn't have HTTPS enabled, but we need some pages to have it on. Wordpress should have this as a setting by default...– AndyApr 25, 2018 at 14:25
-
FYI - that code can be anywhere but needs to be before
require_once( ABSPATH . 'wp-settings.php' );
which is at the end of the file. Sep 20, 2019 at 0:42 -
Another version for the books, just add this to the top of wp-config.php
Reason is that there could be load balancers or something that does not pass along the proper https value, so you have to grab it from elsewhere and fake it for wordpress.
if ( (isset($_SERVER['HTTP_X_FORWARDED_PORT'] ) && ( '443' == $_SERVER['HTTP_X_FORWARDED_PORT'] ))
|| (isset($_SERVER['HTTP_CF_VISITOR']) && $_SERVER['HTTP_CF_VISITOR'] == '{"scheme":"https"}')) {
$_SERVER['HTTPS'] = 'on';
}
-
Just used this solution for a WordPress 5.5.1 install running behind an HAProxy on a pfsense firewall. Others listed didn't seem to work correctly, at least out of the box without some tweaking to HAProxy and the header it's sending.– SwiftSep 24, 2020 at 4:37
-
1None of the other suggestions worked except this one. Thanks a lot 🚀🚀🚀– MahbubNov 16, 2020 at 17:26
5 year old Question...
Okay, I had this error, after installing my SSL Certificate and changing all links that were http
to https
using the wp-cli.phar found here.
I tried various configurations and none seemed to resolve this, unless I set this:
define('FORCE_SSL_ADMIN', true);
define('FORCE_SSL_LOGIN', true);
to this:
define('FORCE_SSL_ADMIN', false);
define('FORCE_SSL_LOGIN', false);
It allowed me to hit the log-in page, but then was unable to actually log-in. I tried answer two but that unfortunately didn't help either, Untill I did the following change:
/** SSL */
define('FORCE_SSL_ADMIN', true);
// in some setups HTTP_X_FORWARDED_PROTO might contain
// a comma-separated list e.g. http,https
// so check for https existence
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== true)
$_SERVER['HTTPS']='on';
For some reason, I do not know why - I had to change the
!== false
to
!== true
I'm running nginx as host and reverse proxy to nginx unit... If anyone has any idea why that worked, Please let me know
Actually... I had this issue and the solving was quite easy and embarassing. Somehow on the webhost my wp-admin folder was deleted and therefore no wp-admin with this same error message.
After hours of testing so many different ways I just saw this and when downloaded and uploaded again it all worked as normal.
Check it guys, it can be that simple.
I had the same issue when I hosted my site on Azure webapp service Linux.
Try this plugin. take care when it active it works. https://wordpress.org/plugins/jsm-force-ssl/
This plugin uses native WordPress filters, instead of PHP’s output buffer, for maximum reliability, performance and caching compatibility (this plugin does not affect caching performance), along with 301 permanent redirects for best SEO (301 redirects are considered best for SEO when moving from HTTP to HTTPS).
Honors proxy / load-balancing variables for large hosting environments:
HTTP_X_FORWARDED_PROTO HTTP_X_FORWARDED_SSL Requirements:
Your web server must be configured with an SSL certificate and able to handle HTTPS request. 😉
Simply activate the plugin and you’re done:
There are no plugin settings to adjust, and no changes are made to your WordPress configuration — simply activate or deactivate the plugin to enable / disable the filters and dynamic redirects.
I ran into this same issue so after hours of research and tweaking things I got it to work. I'd share all I did because I'm not certain if they're all related.
First, I'm hosting my wordpress website on cpanel so I used the Softaculous tool on cpanel to upgrage my wordpress version.
Secondly, I upgraded my wordpress DB.
(I noticed that my .htaccess file in the root folder of my website was updated with an addition of RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
)
Then I checked the .htaccess file of my wp-admin folder then I saw these commands:
Order Allow,Deny
Deny from all
I went to read from the wordpress website that those commands are meant to prevent web access to files in that folder, but this wasn't a behaviour I needed (I think)
So I commented them out and I was able to load my admin section.
Configure CloudFlare to https only and in wp-config set
define('FORCE_SSL_ADMIN', false);
define('FORCE_SSL_LOGIN', false);