20

First off my server is sitting behind a load balancer. My SSL certificate sits on the load balancer and handles HTTPS. The data coming in on port 443 is forwarded to the Wordpress server using HTTP on port 80.

However, wordpress and php do not know my server configuration. This causes the browser to get suspicious about the validity of my valid SSL certificate.

To fix this I added the following code to functions.php. I found this code here and the codex agrees.

/**
 * Make PHP HTTPS aware via HTTP_X_FORWARDED_PROTO
 */
if(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
    $_SERVER['HTTPS']='on';
}

This works great for the frontend, but now the /wp-admin/ is inaccessible even with my Admin account. After logging in I receive a message, "Sorry, you are not allowed to access this page." No other help is provided.

So I searched through the wp-admin folder and discovered that the words "Sorry, you are not allowed to access this page." appear 17 different times.

Most of these error messages are associated with a user permissions check.

How do I keep HTTPS 'on' and retain admin access?

Summary:

  • Before adding HTTP_X_FORWARDED_PROTO logic to functions.php I can access wp-admin/
  • After adding HTTP_X_FORWARDED_PROTO logic to functions.php I cannot access wp-admin/
  • After removing HTTP_X_FORWARDED_PROTO logic to functions.php I cannot access wp-admin/

UPDATE:

I've discovered that the error message is coming from wp-admin/menu.php and this chunk of code at the bottom. I added menu.php to the end of the error to figure out that it was this file.

if ( !user_can_access_admin_page() ) {

    /**
     * Fires when access to an admin page is denied.
     *
     * @since 2.5.0
     */
    do_action( 'admin_page_access_denied' );

    wp_die( __( 'Sorry, you are not allowed to access this page. menu.php'), 403 );
}

I still do not understand how to fix this.

3
  • 1
    You dont say much about the rest of your configuration. Did you set define('FORCE_SSL_ADMIN', true);
    – user42826
    Dec 23, 2016 at 21:57
  • I did not define 'FORCE_SSL_ADMIN'. I will try it.
    – nu everest
    Dec 24, 2016 at 1:30
  • you need to check that the https cookies are also sent from the load balancer over http. It sounds like they are not sent. Obviously also the other way around need to be checked, are the cookies that you set are being transferred over https Dec 24, 2016 at 3:49

1 Answer 1

26

Special thanks to user42826.

According to the codex:

If WordPress is hosted behind a reverse proxy that provides SSL, but is hosted itself without SSL, these options will initially send any requests into an infinite redirect loop. To avoid this, you may configure WordPress to recognize the HTTP_X_FORWARDED_PROTO header (assuming you have properly configured the reverse proxy to set that header).

The following actions will solve the problem.

Add this to wp-config.php. (codex reference)

/* SSL Settings */
define('FORCE_SSL_ADMIN', true);

/* Turn HTTPS 'on' if HTTP_X_FORWARDED_PROTO matches 'https' */
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false) {
    $_SERVER['HTTPS'] = 'on';
}

Remove this from functions.php as it is unnecessary.

/**
 * Make PHP HTTPS aware via HTTP_X_FORWARDED_PROTO
 */
if(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
    $_SERVER['HTTPS']='on';
}
6
  • 1
    The reason is that secure sessions cookies get lost when behind the load balancer because LB is doing SSL but backend is plain http. Nice to see others working on enterprise level architectures ;)
    – user42826
    Dec 24, 2016 at 3:02
  • @user42826 What is nice about this setup is that I can just comment out FORCE_SSL_ADMIN if I want to prohibit admin access, or are there other side effects that should cause me to reconsider this line of thinking?
    – nu everest
    Dec 24, 2016 at 15:32
  • 1
    In your setup, it sounds like not setting FORCE_SSL_ADMIN prevents admin access, but there are better ways to do that depending on your requirements. Examples: prevent wp-admin or wp-login.php access in .htaccess or apache config, remove WP native authentication via plugin, re-architecture WP so that wp-admin url is different than public url, etc
    – user42826
    Dec 25, 2016 at 18:42
  • 8
    Make sure to add this code before the require_once(ABSPATH . 'wp-settings.php'); line. Special thanks to jtl in this answer.
    – Aaroninus
    Sep 14, 2017 at 16:02
  • @Aaroninus thanks, I use Cloudflare flexible SSL and without your comment I would have spent time searching again. I found this related question previously: wordpress.stackexchange.com/questions/170165/…
    – baptx
    Dec 21, 2017 at 12:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.