0

I am developing a site that has an SSL certificate. I've activated wp-admin being conducted over https (using define('FORCE_SSL_ADMIN', true); in wp-config.php).

It's created a lot of issues using wp-admin.

1) Whilst doing things in wp-admin I'll regularly get a message saying the session has expired. As far as I can tell, this mostly happens when jumping from one admin page (url) to another page (url).

2) In Chrome I'll often see a little silver shield in the address bar indicating there are "unsafe scripts" the page is trying to load. I have to then manually tell it to load those scripts (I gather these are scripts wp-admin is trying to load over http, rather than https).

3) Some pages load fine with full HTTPS support (no mixed content) and the EV greenbar, etc. But other pages (in admin) will generate mixed content errors. It seems to be that when switching from a URL with mixed content errors over to one with no such errors (or vice versa) this is when the session expiration issues occurs (not 100% sure about that, but certainly looks that way).

On the front end I used whynopadlock.com to show me which resources were loading over HTTP when using HTTPS, and fixed them (it was simply images in posts, etc.). But since wp-admin requires one to log in, I don't have that option available.

I have two questions:

Q1) Is there a recommended way to get wp-admin to work correctly over SSL?

Q2) What's a recommended way to troubleshoot why wp-admin over SSL is so unstable? (meaning it works on some admin pages, breaks on others, and causes session expiration on others).

Thank you,

Jonathan

  • 1
    Why not turn SSL on for the entire site? – Nathan Powell Mar 21 '16 at 4:04
0

You must check all the files you load within the admin pages (including files loaded from plugins); they should be loaded over HTTPS. WordPress takes care about the files it loads itself, but it doesn't control if you or your plugins load resources over HTTP; you must fix it.

To find the resources loaded over HTTP you can use the Console log of Chrome or Firefox developer tools.

Also, there are some instances of wp-admin that loads resources from front-end. For example, the customizer is in the admin side but the preview is a iframe of the front end. If you have SSL only on admin, you can end up with troubles.

The best thing you can do is to use HTTPS in the entire site. It will be more stable, your users will love it and search engines will love it.

  • Thanks for these suggestions. Regarding moving whole site to SSL. Two questions (which I've not looked into enough to answer for certain myself, 1) Does it prevent caching for being fully functional?, 2) Without making specialised tweaks to the server settings, etc., does it not negatively impact server load? – omega33 Mar 22 '16 at 6:59
  • Caching with SSL is fully functional. Obviously, HTTPS needs more resources from the server because all communications are encrypted; the requests and the responses need to be decrypted and encrypted, but it has not a big negative impact and the benefits are clearly higher after all. – cybmeta Mar 22 '16 at 10:54
0

Another way to fix this is enable wp_debug as it will get you into the WP Admin area and then you can install the Really Simple SSL Plugin and activate...This will help with any mixed-content or session expired warning you're getting on your WordPress website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.