I have a WordPress site behind a reverse proxy. The site is over http, except the wp-admin area, which is under https. We don't have BasicAuth or anything running on top of the admin area.

One of our front-end plugins is failing because it's making a call to https://admin-ajax.php from a front-end http page, and browsers don't seem to like that behavior. (If it matters, the URL string contains nonces)

What's the best way to allow for front-end calls to admin-ajax.php? Should I redirect all calls to that file from https to http? If yes, how can I do that while still requiring all other files under /wp-admin to be under https?

Any suggestions would be much appreciated.

PS: The code below is what we currently have in wp-config:

if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
  • sounds like you need to fix the plugin, or it might be that the plugin is right and you should serve the whole page under https Dec 4 '14 at 17:50
  • Front end Ajax is tricky especially with sites trying to hide ssl URLs. Trust me I know. The best way to approach this is with WordPress's new REST API. Apr 12 '16 at 3:47
  • close voting as obviously the problem is with the plugin for which the code is not given Dec 15 '16 at 15:33
  • Have you considered using the REST API? This would place all your requests under /wp-json instead, bypassing the issue entirely, just keep in mind you will want to serve authenticated wp-json requests over SSL. Consider changing your rules to users who have cookies, rather than wp-admin requests
    – Tom J Nowell
    Apr 8 '18 at 19:02

I would recommend to define this constant in your wp-config.php to force HTTPS on admin:

define('FORCE_SSL_ADMIN', true);

Also, there is a function called is_admin() which could be helpful in your case.

if ( is_admin() ) {
    $_SERVER['HTTPS'] = 'on';

However, if you have a rule in your web server forcing all wp-admin and wp-login.php requests to run over SSL, you will need to add an exception for admin-ajax.php file. Not sure how to implement this in Apache, but for NGINX the easiest way would be something like:

if ($request_uri !~* "^/wp-admin/admin-ajax\.php") { rewrite "^/wp-(admin|login)" https://$host$request_uri permanent; }

Hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.