I ran into mixed content with SSL issues. I've applied for Let's encrypt SSL certificate for my test wordpress site behind a reverse proxy(articaproxy).

The same SSL certificate has been deployed in reverse proxy server and wordpress virtual host.

The reverse proxy http/https redirect works fine.

I forced the siteurl and home url to https in mysql database, to test https

While open my wordpress web site, and click show block content. chrome console prompt 'This page is insecure (broken HTTPS).'

Chrome console also report that there are some stylesheet/script/image are not served over HTTPS stylesheet/script/image are not served over HTTPS

I've tried to install related plugins to fix this, but failed. So they are disabled. plugins to fix mixed content

The admin area of my wordpress can not be loaded, due to ERR_TOO_MANY_REDIRECTS

I would like to know how to fix the mixed content and too many redirects in admin logon page issues.

Suggestions are welcomed.

****************** Update ***********************

Hi~ I would like to provide more details about my test wordpress site settings.

Parts of my wp-config.php values related to WP_SITEURL, WP_HOME, HTTPS:

define('WP_SITEURL', 'https://'.$_SERVER['HTTP_HOST']);
define('WP_HOME', 'https://'.$_SERVER['HTTP_HOST']);
define('FORCE_SSL_ADMIN', true);

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
$_SERVER['HTTPS']='on';

'siteurl' & 'home' values from field of wp_options in wordpress DB:

https://yuantafood.i-shopping.email
https://yuantafood.i-shopping.email

As commented above, I could only login wp-admin page with my internal IP address. Try to login wp-admin page with external IP/FQDN can not be loaded, due to error: ERR_TOO_MANY_REDIRECTS.

With googled for many posts, force SSL with .htaccess seems worked for others to escape the mixed content issues.

I also tried with many methods to edit .htaccess, mainly 301 permanently redirect and 302 temporarily redirect.

values of .htaccess file in the wordpress folder(301)

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On

# RewriteBase /
# RewriteRule ^index\.php$ - [L]
# RewriteCond %{REQUEST_FILENAME} !-f
# RewriteCond %{REQUEST_FILENAME} !-d
# RewriteRule . /index.php [L]

RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://yuantafood.i-shopping.email/$1 [R=301,L]

</IfModule>
# END WordPress

# Wordfence WAF
<IfModule mod_php5.c>
php_value auto_prepend_file '/var/www/wordpress/wordfence-waf.php'
</IfModule>
<Files ".user.ini">
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</Files>
# END Wordfence WAF

Both 301 & 302 redirect failed, and caused all site can not be loaded due to ERR_TOO_MANY_REDIRECTS.

  • Here are two screen shots and observes from reverse proxy events about HTTP redirect HTTPS failed. 301 redirect & 302 redirect – Owen Jan 25 '17 at 19:55
up vote 0 down vote accepted

Remove all of the force SSL plugins that you're running, revert back to your default settings in the wp-config.php and .htaccess before applying forces to use HTTPS. This will remove all of the conflicts you are having and the redirect loops. After that, follow these steps:

  1. Go and download Interconnect IT's Database Search & Replace Script here
  2. Unzip the file and drop the folder where your WordPress is installed (the root) and rename the folder to replace (screenshot)
  3. Navigate to the new folder you created in your browser (ex: http://yuantafood.i-shopping.email/replace) and you will see the search/replace tool
  4. In the "search for…" and "replace with…" fields:
    • Replace: http://yuantafood.i-shopping.email/ (HTTP, non-SSL)
    • With: https://yuantafood.i-shopping.email/ (HTTPS)

You can click the dry run button under actions to see what it will be replacing before you execute the script. Once you're done be sure to remove the /replace/ folder.

Following the steps above should make sure all of your links are running on HTTPS. However, you can also use the Remove HTTP plugin to ensure that there is no more mixed content issues.

  • 1
    Hi~ I've run Search & Replace Script DB script before. Following your steps, I run it again. Very surprising that the value:'yuantafood.i-shopping.email' still can be found on wp_wfHits table! Are they generated automatically? here are my screen shot after run search & replace. Thanks to you, the number of mixed content has down to 1. And the annoying ERR_TOO_MANY_REDIRECTS has disappeared on wp-admin page external link :) mixed content: wp-emoji-release.min.js – Owen Jan 25 '17 at 21:10
  • @Owen Moving forward, you shouldn't experience any HTTP requests from your site since they are all updated. If you're using any cache plugin, be sure to clear your cache from your website and browser. Are you using the Remove HTTP plugin? – Ethan Jinks O'Sullivan Jan 25 '17 at 21:27
  • Thank you! with all of you helps, I'm on the way of moving forward. How do I clear cache from wordpress website? I'm using Remove HTTP plugin as Ethan suggested, After enabling and disabling of test Remove HTTP, It minimized the mixed content to 1. List of my currently enabled plugins. – Owen Jan 25 '17 at 21:45
  • @Owen Doesn't look like any of those plugins will cause any issue. If I manually type out https://yuantafood.i-shopping.email it will load SSL without any issues. This means your question has been solved. To prevent this thread from overloading with comments and going off-topic, click the checkmark next to my answer and open a new question on how to force your website to use HTTPS (SSL). – Ethan Jinks O'Sullivan Jan 26 '17 at 2:31
  • 1
    I just follow another comment from @thaevok . Add $_SERVER['HTTPS'] = 'on'; to wp-config.php works for me. Now, http redirect to https perfectly. – Owen Jan 27 '17 at 19:27

Have you changed the "WordPress Address (URL)" and "Site Address (URL)" at Settings -> General on WP-Admin to from http to https? Flush the cache and check again? If there are still mixed protocols, it probably came from hardcoded url such as images and external links. You can leave it as is, or fix it. I gone through this when I switched to SSL, you can take a look at the later part of my article.

  • Thank you for reply. Since I've forced siteurl and home fields in wp_options table with value 'yuantafood.i-shopping.email' The "WordPress Address (URL)" and "Site Address (URL)" at Settings are grey text: imgur.com/C4ajdBx I do flush cache and check again, mixed content issue remains. I could only login admin page with internal IP address. Which is not affected by ERR_TOO_MANY_REDIRECTS: imgur.com/YBrUess Thanks for the article, Why No Padlock is a very useful site. Setting rule to redirect HTTP to HTTPS in .htaccess works for other, not for me. – Owen Jan 23 '17 at 17:14
  • Are you on Apache or Nginx? .htaccess only works for Apache. – hcheung Jan 24 '17 at 0:20
  • Hi~ I'm using Apache version 2.4.10 . – Owen Jan 24 '17 at 6:11

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.