I have a Wordpress installation in the root directory of my host. It includes an SSL certificate for that primary domain (e.g.
domain.com; not a wildcard certificate).
When I include
define('FORCE_SSL_ADMIN', true); in wp-config.php, suddenly all subdomains also try to redirect to https, despite the fact that there is no SSL certificate for those subdomains.
Some of the subdomains are also Wordpress installs in subfolders of my host (e.g.
test.domain.com), but others are hosted on completely separate hosts.
When I look at
chrome://net-internals/#hsts I see:
static_sts_domain: static_upgrade_mode: UNKNOWN static_sts_include_subdomains: static_sts_observed: static_pkp_domain: static_pkp_include_subdomains: static_pkp_observed: static_spki_hashes: dynamic_sts_domain: domain.com dynamic_upgrade_mode: STRICT dynamic_sts_include_subdomains: true dynamic_sts_observed: 1477318558.379693 dynamic_pkp_domain: dynamic_pkp_include_subdomains: dynamic_pkp_observed: dynamic_spki_hashes:
Why would FORCE_SSL_ADMIN affect
dynamic_sts_include_subdomains? Is there any way around this, while still keeping adequate security in my WP Admin?