I am using nginx as my webserver and i have edited the configuration file to point to https, so i change the WordPress url settings to https and also added the WordPress force ssl admin code to my wp-config file but I keep running into the error "This webpage has a redirect loop"

enter image description here


9 Answers 9


You've added $_SERVER['HTTPS'] = 'on'; to your wp-config.php?

You should also use the WP Migrate DB plugin to migrate from http://yoursite.com to https://yoursite.com

  • 12
    I would give you a 1000 upvotes for this!
    – Sheharyar
    Jan 17, 2016 at 21:56
  • 6
    For some reason, this vital step is so often not included. Jan 27, 2016 at 6:47
  • 5
    Thank you! That probably saved me a few more hours of trying to figure out why the admin area wasn't working with SSL. Feb 20, 2016 at 17:42
  • 4
    wow! $_SERVER['HTTPS'] = 'on'; saved me!
    – PJunior
    Feb 3, 2017 at 17:13
  • 2
    Why does this work? I already used Interconnect's S&R tool. I should already have the right protocol in the database.
    – Jeff
    Feb 15, 2017 at 20:28

I had a similar problem and just added the following snippet to my wp-config.php:

/** SSL */  
define('FORCE_SSL_ADMIN', true);  
// in some setups HTTP_X_FORWARDED_PROTO might contain  
// a comma-separated list e.g. http,https  
// so check for https existence  
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)  

as suggested in the Codex. This will only be needed in case there's SSL passthrough enabled in your load balancer (or firewall) setup. Meaning that while you can access the site via HTTP within TLS/SSL, the communication that your server receives is HTTP only. To account for that, above header is needed so WordPress can "set" HTTPS to on in the $_SERVER config array.

  • 2
    This is great solution specifically for anyone using a load balancer. I was hosting this using Dokku (a host-it-yourself clone of Heroku) and having problems with static resource loading and the wp-admin redirect loop. Dokku also does an nginx reverse proxy to forward incoming 443 traffic to port 80 and this fixes the issue.
    – ZachM
    Jun 6, 2016 at 14:54
  • 3
    I had to just put the $_SERVER['HTTPS'] = 'on'; because HTTP_X_FORWARDED_PROTO is not even in the settings on my client's server :| Jan 23, 2017 at 17:11
  • 1
    Fixed my issue perfectly when using an AWS load balancer.
    – Josh
    Apr 12, 2017 at 15:27
  • This also fixed the "Too many redirect issue" as my site is behind a load balancer on AWS.
    – voam
    Nov 1, 2017 at 19:24
  • I think is important to add to this answer the fix for the .htaccess file for such cases: stackoverflow.com/questions/36748110/…, check @harshal-lonare answer. Oct 5, 2018 at 15:29

As I do not have the comment privilege yet, I will post this addition as another answer:

The solution proposed by Elias, to add the following to wp-config.php, did the trick for me:

/** SSL */  
define('FORCE_SSL_ADMIN', true);  
// in some setups HTTP_X_FORWARDED_PROTO might contain  
// a comma-separated list e.g. http,https  
// so check for https existence  
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)  

However, it only worked for me when I put it before everything else in this file!

  • 1
    This was exactly what my problem was. I had put these at the end of the file and it wasn't working. I was ready to rebuild my site from scratch. Moved them to the top and bam, issue fixed. Thank you, Thank you!! Feb 3, 2018 at 2:19
  • 1
    This solution is great if you're using a flexible SSL behind a proxy DNS like Cloudflare. Thank you.
    – Stefan P
    Feb 16, 2018 at 5:44
  • Confirmed working. Thank you so much, this fixes a lot of problems we had with API's and IFrames. The site doesn't have HTTPS enabled, but we need some pages to have it on. Wordpress should have this as a setting by default...
    – Andy
    Apr 25, 2018 at 14:25
  • FYI - that code can be anywhere but needs to be before require_once( ABSPATH . 'wp-settings.php' ); which is at the end of the file. Sep 20, 2019 at 0:42
  • This works, thanks Apr 28, 2020 at 0:22

Another version for the books, just add this to the top of wp-config.php

Reason is that there could be load balancers or something that does not pass along the proper https value, so you have to grab it from elsewhere and fake it for wordpress.

if ( (isset($_SERVER['HTTP_X_FORWARDED_PORT'] ) && ( '443' == $_SERVER['HTTP_X_FORWARDED_PORT'] ))
    || (isset($_SERVER['HTTP_CF_VISITOR']) && $_SERVER['HTTP_CF_VISITOR'] == '{"scheme":"https"}')) {
    $_SERVER['HTTPS'] = 'on';
  • Just used this solution for a WordPress 5.5.1 install running behind an HAProxy on a pfsense firewall. Others listed didn't seem to work correctly, at least out of the box without some tweaking to HAProxy and the header it's sending.
    – Swift
    Sep 24, 2020 at 4:37
  • 1
    None of the other suggestions worked except this one. Thanks a lot 🚀🚀🚀
    – Mahbub
    Nov 16, 2020 at 17:26

5 year old Question...

Okay, I had this error, after installing my SSL Certificate and changing all links that were http to https using the wp-cli.phar found here.

I tried various configurations and none seemed to resolve this, unless I set this:

define('FORCE_SSL_ADMIN', true); 
define('FORCE_SSL_LOGIN', true);

to this:

define('FORCE_SSL_ADMIN', false);
define('FORCE_SSL_LOGIN', false);

It allowed me to hit the log-in page, but then was unable to actually log-in. I tried answer two but that unfortunately didn't help either, Untill I did the following change:

/** SSL */   
define('FORCE_SSL_ADMIN', true);
// in some setups HTTP_X_FORWARDED_PROTO might contain
// a comma-separated list e.g. http,https   
// so check for https existence   
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== true)  

For some reason, I do not know why - I had to change the

!== false


!== true

I'm running nginx as host and reverse proxy to nginx unit... If anyone has any idea why that worked, Please let me know


Actually... I had this issue and the solving was quite easy and embarassing. Somehow on the webhost my wp-admin folder was deleted and therefore no wp-admin with this same error message.

After hours of testing so many different ways I just saw this and when downloaded and uploaded again it all worked as normal.

Check it guys, it can be that simple.


I had the same issue when I hosted my site on Azure webapp service Linux.

Try this plugin. take care when it active it works. https://wordpress.org/plugins/jsm-force-ssl/

This plugin uses native WordPress filters, instead of PHP’s output buffer, for maximum reliability, performance and caching compatibility (this plugin does not affect caching performance), along with 301 permanent redirects for best SEO (301 redirects are considered best for SEO when moving from HTTP to HTTPS).

Honors proxy / load-balancing variables for large hosting environments:


Your web server must be configured with an SSL certificate and able to handle HTTPS request. 😉

Simply activate the plugin and you’re done:

There are no plugin settings to adjust, and no changes are made to your WordPress configuration — simply activate or deactivate the plugin to enable / disable the filters and dynamic redirects.


I ran into this same issue so after hours of research and tweaking things I got it to work. I'd share all I did because I'm not certain if they're all related.

First, I'm hosting my wordpress website on cpanel so I used the Softaculous tool on cpanel to upgrage my wordpress version.

Secondly, I upgraded my wordpress DB.

(I noticed that my .htaccess file in the root folder of my website was updated with an addition of RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] )

Then I checked the .htaccess file of my wp-admin folder then I saw these commands:

Order Allow,Deny
Deny from all

I went to read from the wordpress website that those commands are meant to prevent web access to files in that folder, but this wasn't a behaviour I needed (I think)

So I commented them out and I was able to load my admin section.


Configure CloudFlare to https only and in wp-config set

define('FORCE_SSL_ADMIN', false);
define('FORCE_SSL_LOGIN', false);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.