0

I've searched here and the WP Codex but haven't found anything.

I have recently added an SSL Cert to a client site. The front end is fine and there are no insecure elements.

However, the admin dashboard has lots of insecure elements. A simple search shows that there are about 20 files in both wp-admin and wp-includes that have the following link hard coded: http://www.w3.org/1999/xhtml

There is no switch, as when using this config: define('FORCE_SSL_ADMIN', true);

I understand what this link is, and why it is needed. But I do not want to edit the core to force Admin to be secure.

Does anyone have any suggestions how I fix this?

Improve this question
1
  • Thanks. So does this mean it is impossible to have a truly secure dashboard?
    – Mr_DW_Brighton
    Commented Sep 16, 2015 at 11:12

1 Answer 1

Reset to default
1

There isn't a proper https/SSL variant of the link you have given, so probably, likely you are getting problems when enforcing it - no matter how you do it. I strongly assume that is the reason why the "unsecure" URL is used in the first place.

From comment:

So does this mean it is impossible to have a truly secure dashboard?

Firstly I'd say, the URL you are talking about is more or less documentary. Secondly, if an external source is malicious, then it really doesn't matter if it is accessed via SSL or not.

Improve this answer
3
  • It seems that you're suggesting I remove this link as its documentary. Is that right? I am not too keen to edit Core files to achieve this, My question is really how to do this without compromising the Core. As you can see the link is to the W3C xhmtl page, so even though its not malicious, it stops the page being fully secure.
    – Mr_DW_Brighton
    Commented Sep 16, 2015 at 11:33
  • No, I'd say, let it be. It isn't that much documentary as it declares/defines the namspace - read up on the html tags xmlns property. On the other hand the one used, so w3.org/1999/xhtml, is the default, which will be used anyway even if you leave it out. @Mr_DW_Brighton
    – Nicolai Grossherr
    Commented Sep 16, 2015 at 11:39
  • Thanks for the advice. I don't have an alternative to leaving it there. As I say, I really don't want to touch the core files. Thanks DW
    – Mr_DW_Brighton
    Commented Sep 16, 2015 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.