3

I have a WordPress site behind a reverse proxy. The site is over http, except the wp-admin area, which is under https. We don't have BasicAuth or anything running on top of the admin area.

One of our front-end plugins is failing because it's making a call to https://admin-ajax.php from a front-end http page, and browsers don't seem to like that behavior. (If it matters, the URL string contains nonces)

What's the best way to allow for front-end calls to admin-ajax.php? Should I redirect all calls to that file from https to http? If yes, how can I do that while still requiring all other files under /wp-admin to be under https?

Any suggestions would be much appreciated.

PS: The code below is what we currently have in wp-config:

if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
$_SERVER['HTTPS']='on';
4
  • sounds like you need to fix the plugin, or it might be that the plugin is right and you should serve the whole page under https Dec 4, 2014 at 17:50
  • Front end Ajax is tricky especially with sites trying to hide ssl URLs. Trust me I know. The best way to approach this is with WordPress's new REST API. Apr 12, 2016 at 3:47
  • close voting as obviously the problem is with the plugin for which the code is not given Dec 15, 2016 at 15:33
  • Have you considered using the REST API? This would place all your requests under /wp-json instead, bypassing the issue entirely, just keep in mind you will want to serve authenticated wp-json requests over SSL. Consider changing your rules to users who have cookies, rather than wp-admin requests
    – Tom J Nowell
    Apr 8, 2018 at 19:02

1 Answer 1

1

I would recommend to define this constant in your wp-config.php to force HTTPS on admin:

define('FORCE_SSL_ADMIN', true);

Also, there is a function called is_admin() which could be helpful in your case.

if ( is_admin() ) {
    $_SERVER['HTTPS'] = 'on';
}

However, if you have a rule in your web server forcing all wp-admin and wp-login.php requests to run over SSL, you will need to add an exception for admin-ajax.php file. Not sure how to implement this in Apache, but for NGINX the easiest way would be something like:

if ($request_uri !~* "^/wp-admin/admin-ajax\.php") { rewrite "^/wp-(admin|login)" https://$host$request_uri permanent; }

Hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.