0

I have a Wordpress installation in the root directory of my host. It includes an SSL certificate for that primary domain (e.g. domain.com; not a wildcard certificate).

When I include define('FORCE_SSL_ADMIN', true); in wp-config.php, suddenly all subdomains also try to redirect to https, despite the fact that there is no SSL certificate for those subdomains.

Some of the subdomains are also Wordpress installs in subfolders of my host (e.g. test.domain.com), but others are hosted on completely separate hosts.

When I look at chrome://net-internals/#hsts I see:

static_sts_domain: 
static_upgrade_mode: UNKNOWN
static_sts_include_subdomains: 
static_sts_observed: 
static_pkp_domain: 
static_pkp_include_subdomains: 
static_pkp_observed: 
static_spki_hashes: 
dynamic_sts_domain: domain.com
dynamic_upgrade_mode: STRICT
dynamic_sts_include_subdomains: true
dynamic_sts_observed: 1477318558.379693
dynamic_pkp_domain: 
dynamic_pkp_include_subdomains: 
dynamic_pkp_observed: 
dynamic_spki_hashes:  

Why would FORCE_SSL_ADMIN affect dynamic_sts_include_subdomains? Is there any way around this, while still keeping adequate security in my WP Admin?

  • I have a feeling your problem is due to something else. Try commenting out the FORCE_SSL_ADMIN in wp-config.php... then see if your subdomains are redirecting to https. IMO, you have another configuration somewhere that is forcing the subdomains to https. – user42826 Oct 26 '16 at 4:09
  • Removing/Commenting out FORCE_SSL_ADMIN fixes the issue. I took it out, and haven't had any problems since. But I still don't understand why that would happen. – dpruth Oct 31 '16 at 19:26
0

It turns out that the shared server I have at Network Solutions is forcing HSTS through their service. And since it's a shared hosting server, they refuse to change it.

The solution: I purchased a Wildcard certificate, and installed it on multiple servers for each subdomain.

-1

It sounds like you're using WordPress Multisite which means all your domains share the same wp-config.php.

If this is the case, you can limit SSL to only that one domain by wrapping an if statement around the define( 'FORCE_SSL_ADMIN', true ).

NOTE: Make sure to change the domain.com to whatever your true SSL website domain name is.

if ( 'domain.com' == $_SERVER['HTTP_HOST'] ) {
  define( 'FORCE_SSL_ADMIN', true );
}
  • I'm not using a multisite, but it does seem like the wp-config is affecting more than just the primary domain. – dpruth Oct 25 '16 at 12:58
  • I tried that, but it continues to affect subdomains. I'm not using a multisite, and not all of the subdomains are even Wordpress sites. One is a pretty basic PHP site and the other has the open-source ResourceSpace installed. ResourceSpace is even hosted on a completely different host with a CNAME DNS record pointing to it. – dpruth Oct 25 '16 at 13:04
  • Okay, if it's affecting sites hosted on totally different servers, the issue is not what I thought it was. It sounds more like a DNS or server configuration issue. Hard to help you further without looking at those configs. :-( I'd contact your host provider or whomever you purchased the SSL cert from. – cowgill Oct 26 '16 at 1:32
  • ddownvoted as this is a great way to get your user hacked in a MS enviroment. It is cool (but not very smart) if you decide to keep the site on HTTP, but never do half a job with SSL, as there is no such thing as partially secure – Mark Kaplun May 8 '17 at 16:35
  • ,,, actually it will also break your ability to login once for all the sites in the network – Mark Kaplun May 8 '17 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.