I've seen several questions posted but they either blow passed this specific item or go unanswered.

Basically, I have a load balance set up between two instances of the same wordpress website with nginx out front. In order to successfully login I have to pin all requests for /wp-admin or /wp-login.php to a particular server. It doesn't seem to matter which server, as long all the requests go to the same server.

At first I thought one server was saving session data, but I clustered my PHP sessions only to find it not saving anything. I've checked cookies but nothing server-sensitive appears there (just the WP test cookie which has static value). I continuously monitored the file system to see if maybe a file was being created on one of the backend application servers but to no avail. I've even checked the login form which seems about as basic as they come.

I just literally have no idea why WP would even care which server actually got the POST request.

I can supply the nginx config if you want but it's pretty straightforward and I don't want to clutter this post.

  • 1
    @A5hleyRich at Delicious Brains is currently in the midst of doing a post series on this, might be worth reaching out to him on Twitter for some intel Nov 15, 2017 at 16:08
  • does the 2 server use the same database ? because on login, WP stores the session identifier in DB and at every request, tests if the ID in the cookie is a valid session ID (not expired and exists in the DB)
    – mmm
    Nov 16, 2017 at 22:26

1 Answer 1


A few things to check on:

  • Review wp_salt. Make sure all of the web servers are running on the same set of salts in the wp-config.php file. Ideally, these should be mirrored from a single location.

  • Review is_ssl() and make sure this function is properly detecting SSL across all of your web servers. I've seen this little function cause a lot of headaches when the load balancer makes an internal connection on port 80 to the web server. If is_ssl() doesn't detect this (due to load balancing) it may cause this problem; i.e., possible cookie protocol changes.

One quick solution is to check for the forwarded protocol in wp-config.php

if ( ! empty( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
        && strcasecmp( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) === 0 ) {
    $_SERVER['HTTPS'] = 'on'; // Convince WordPress.
  • Review the $_SERVER['REMOTE_ADDR'] environment variable and make sure this is being populated in the same way across all web servers. There are many plugins for WordPress that will use this, not considering a load balanced scenario.

    Easiest way to check is to dump the <?php phpinfo(); on a few web servers and check if they are all setting this properly. Or does the actual IP address end up in HTTP_X_FORWARDED_FOR, HTTP_CLIENT_IP, or something else? In short, avoid confusing plugins by fixing REMOTE_ADDR.

  • Make sure system time is in sync across all web servers.

  • Look more closely at any plugins that have the goal of preventing brute-force attacks, as these are more likely to be doing some strict validation; e.g., testing user-agent, IP addr, changes in ip address, etc. Their job is to not be fooled, but sometimes they produce false-positives.

If problems persist, please post a list of the active plugins you're running and the Nginx configuration you mentioned. FastCGI params would be good to look at, along with any proxy configuration you may or may not have.

  • Thanks for the thorough response. The salts were the issue for me. Once the wp-config.php on each app server matched then it started to work being fully load balanced. Can you explain a little bit about what each is used for?
    – Bratchley
    Nov 17, 2017 at 14:50
  • 1
    Take a look here at the breakdown: wisdmlabs.com/blog/decoding-wordpress-salts-and-keys
    – jaswrks
    Nov 21, 2017 at 11:30
  • You saved my day. When using multiple servers behind a load balancer, the salt keys must be the same.
    – RonZ
    Aug 21, 2019 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.