WordPress logs out users any time their protocol switches between HTTPS and HTTP. This is a real problem in a commerce environment where checkout forces SSL.

I've run into this a handful of time over the years and I've normally resolved the issue by going full SSL across the entire site. The problem is that this particular client sees HTTPS as additional overhead (not open for debate) and doesn't want it enabled anywhere it's not required by a secure transaction.

Basically, I can log into the site using https, switch protocols in the URL, and I'll be insta-logged. Works the same way in both directions.

I understand that changing the protocol is invalidating the session, what I don't understand is how to work around it; bearing in mind that I don't have any choice in the matter.

Technical details:

  • Running the latest WordPress with a commerce-oriented plugin load. Nothing that isn't working without incident on other client sites.
  • Running as a node on a WordPress multi-site network (this is more likely the culprit)
  • Server is running on Ubuntu via AWS. I have shell access but I don't have a mandate to tinker. Too many other things can go wrong.


  • 1
    This may help, specifically the comments by Otto here – czerspalace Apr 14 '15 at 20:48
  • Yeah, I've got a bit of old school thinking on SSL as being computationally expensive and I'm not in any position to argue in favor of full SSL. It's a political hot potato I don't want to juggle. – Imperative Ideas Apr 15 '15 at 17:36
  • So the bottom line is that I'd need WordPress to create both secure and insecure cookies, which isn't practical. Got it :) – Imperative Ideas Apr 15 '15 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.