EDIT: Turns out the solution was to simply re-install wordpress (it was a new blog anyways). Still not sure what the issue really was but that solved it.

I have tried every single fix on stackexchange and other websites and nothing has resolved the issue.

I have checked to see that wp_ is in front of all my tables. I have updated http:// to https:// everywhere in the database. I have tried the FORCE_SSL_ADMIN thing with/without $_SERVER['HTTPS']='on' etc. etc.

I currently have this in my wp-config.php. I have tried placing it at the top at the bottom, and everywhere in between:

define('FORCE_SSL_ADMIN', true);
if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')

I currently have this in my htaccess above the wordpress stuff (have also tried putting it below):

RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*) https://www.%{SERVER_NAME}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^(.*) https://%{SERVER_NAME}%{REQUEST_URI} [L,R=301]

I know the issue is because user capabilities are not getting set with https for some reason. I just don't know why or how to fix it.

For example, all these capabilities are set with http but not https:

[switch_themes] => 1 
[edit_themes] => 1 
[activate_plugins] => 1 
[edit_plugins] => 1 
[edit_users] => 1 
[edit_files] => 1


I get: "Sorry, you are not allowed to access this page." no matter what I've tried.

I am about ready to throw in the towel and just offer to pay somebody because I've spent 3 days on this now but I figured I'd ask on here first.

Any help would be appreciated!

  • Have you tried accessing the website on a clean browser window, like an incognito window? Nov 14, 2018 at 20:21
  • I have yes. Tried incognito on 2 different computers with firefox and chrome.
    – WMaster99
    Nov 14, 2018 at 21:46
  • Make sure that the FORCE_SSL_ADMIN and check for HTTP_X_FORWARDED_PROTO are before the line that includes wp-settings.php. You could also try to check that "https" exists in HTTP_X_FORWARDED_PROTO instead of checking if it is an exact match, with false !== strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) Nov 14, 2018 at 22:29
  • Okay I tried that too but no luck
    – WMaster99
    Nov 15, 2018 at 0:48

2 Answers 2


I would recommend NOT forcing HTTPS quite yet. Instead, remove all that stuff in wp-config.php and in the .htaccess. Then, login to WordPress making sure you're using the HTTPS link.

If you can login, then you now know you can login as both HTTP and HTTPS. Then, you can force HTTPS. If you can login at HTTP but not HTTPS, then I would recommend changing your SALT keys in your wp-config.php file (https://api.wordpress.org/secret-key/1.1/salt/) and visiting the site again in private browsing mode.

SSL certificates get cached by your browser and changing the SALT keys can often force these pesky caches to update.

  • Okay, I removed everything in htaccess and wp-config but I still get the same result. The capabilities/permissions/whatever don't get set with https.
    – WMaster99
    Nov 14, 2018 at 21:22

Similar to @justin-downey I'd do the following:

1) Remove all the htaccess, wp-config settings 2) Work from a different browser completely in order to avoid browser cached versions 3) Login to MySQL and check wp_options for the home_url and site_url and make sure they are both set with HTTPS -- that should be the ONLY place HTTPS is configured.

You should be fine from there, then add your htaccess redirect -- skip the wp-config rules since all will work fine with the url set correctly in the database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.