I have a Wordpress installation in the root directory of my host. It includes an SSL certificate for that primary domain (e.g. domain.com; not a wildcard certificate).

When I include define('FORCE_SSL_ADMIN', true); in wp-config.php, suddenly all subdomains also try to redirect to https, despite the fact that there is no SSL certificate for those subdomains.

Some of the subdomains are also Wordpress installs in subfolders of my host (e.g. test.domain.com), but others are hosted on completely separate hosts.

When I look at chrome://net-internals/#hsts I see:

static_upgrade_mode: UNKNOWN
dynamic_sts_domain: domain.com
dynamic_upgrade_mode: STRICT
dynamic_sts_include_subdomains: true
dynamic_sts_observed: 1477318558.379693

Why would FORCE_SSL_ADMIN affect dynamic_sts_include_subdomains? Is there any way around this, while still keeping adequate security in my WP Admin?

  • I have a feeling your problem is due to something else. Try commenting out the FORCE_SSL_ADMIN in wp-config.php... then see if your subdomains are redirecting to https. IMO, you have another configuration somewhere that is forcing the subdomains to https.
    – user42826
    Oct 26, 2016 at 4:09
  • Removing/Commenting out FORCE_SSL_ADMIN fixes the issue. I took it out, and haven't had any problems since. But I still don't understand why that would happen.
    – dpruth
    Oct 31, 2016 at 19:26

2 Answers 2


It turns out that the shared server I have at Network Solutions is forcing HSTS through their service. And since it's a shared hosting server, they refuse to change it.

The solution: I purchased a Wildcard certificate, and installed it on multiple servers for each subdomain.


It sounds like you're using WordPress Multisite which means all your domains share the same wp-config.php.

If this is the case, you can limit SSL to only that one domain by wrapping an if statement around the define( 'FORCE_SSL_ADMIN', true ).

NOTE: Make sure to change the domain.com to whatever your true SSL website domain name is.

if ( 'domain.com' == $_SERVER['HTTP_HOST'] ) {
  define( 'FORCE_SSL_ADMIN', true );
  • I'm not using a multisite, but it does seem like the wp-config is affecting more than just the primary domain.
    – dpruth
    Oct 25, 2016 at 12:58
  • I tried that, but it continues to affect subdomains. I'm not using a multisite, and not all of the subdomains are even Wordpress sites. One is a pretty basic PHP site and the other has the open-source ResourceSpace installed. ResourceSpace is even hosted on a completely different host with a CNAME DNS record pointing to it.
    – dpruth
    Oct 25, 2016 at 13:04
  • Okay, if it's affecting sites hosted on totally different servers, the issue is not what I thought it was. It sounds more like a DNS or server configuration issue. Hard to help you further without looking at those configs. :-( I'd contact your host provider or whomever you purchased the SSL cert from.
    – cowgill
    Oct 26, 2016 at 1:32
  • ddownvoted as this is a great way to get your user hacked in a MS enviroment. It is cool (but not very smart) if you decide to keep the site on HTTP, but never do half a job with SSL, as there is no such thing as partially secure May 8, 2017 at 16:35
  • ,,, actually it will also break your ability to login once for all the sites in the network May 8, 2017 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.