EDIT: Turns out the solution was to simply re-install wordpress (it was a new blog anyways). Still not sure what the issue really was but that solved it.

I have tried every single fix on stackexchange and other websites and nothing has resolved the issue.

I have checked to see that wp_ is in front of all my tables. I have updated http:// to https:// everywhere in the database. I have tried the FORCE_SSL_ADMIN thing with/without $_SERVER['HTTPS']='on' etc. etc.

I currently have this in my wp-config.php. I have tried placing it at the top at the bottom, and everywhere in between:

define('FORCE_SSL_ADMIN', true);
if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')

I currently have this in my htaccess above the wordpress stuff (have also tried putting it below):

RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*) https://www.%{SERVER_NAME}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^(.*) https://%{SERVER_NAME}%{REQUEST_URI} [L,R=301]

I know the issue is because user capabilities are not getting set with https for some reason. I just don't know why or how to fix it.

For example, all these capabilities are set with http but not https:

[switch_themes] => 1 
[edit_themes] => 1 
[activate_plugins] => 1 
[edit_plugins] => 1 
[edit_users] => 1 
[edit_files] => 1


I get: "Sorry, you are not allowed to access this page." no matter what I've tried.

I am about ready to throw in the towel and just offer to pay somebody because I've spent 3 days on this now but I figured I'd ask on here first.

Any help would be appreciated!

  • Have you tried accessing the website on a clean browser window, like an incognito window? – Cristiano Baptista Nov 14 '18 at 20:21
  • I have yes. Tried incognito on 2 different computers with firefox and chrome. – WMaster99 Nov 14 '18 at 21:46
  • Make sure that the FORCE_SSL_ADMIN and check for HTTP_X_FORWARDED_PROTO are before the line that includes wp-settings.php. You could also try to check that "https" exists in HTTP_X_FORWARDED_PROTO instead of checking if it is an exact match, with false !== strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) – Cristiano Baptista Nov 14 '18 at 22:29
  • Okay I tried that too but no luck – WMaster99 Nov 15 '18 at 0:48

I would recommend NOT forcing HTTPS quite yet. Instead, remove all that stuff in wp-config.php and in the .htaccess. Then, login to WordPress making sure you're using the HTTPS link.

If you can login, then you now know you can login as both HTTP and HTTPS. Then, you can force HTTPS. If you can login at HTTP but not HTTPS, then I would recommend changing your SALT keys in your wp-config.php file (https://api.wordpress.org/secret-key/1.1/salt/) and visiting the site again in private browsing mode.

SSL certificates get cached by your browser and changing the SALT keys can often force these pesky caches to update.

  • Okay, I removed everything in htaccess and wp-config but I still get the same result. The capabilities/permissions/whatever don't get set with https. – WMaster99 Nov 14 '18 at 21:22

Similar to @justin-downey I'd do the following:

1) Remove all the htaccess, wp-config settings 2) Work from a different browser completely in order to avoid browser cached versions 3) Login to MySQL and check wp_options for the home_url and site_url and make sure they are both set with HTTPS -- that should be the ONLY place HTTPS is configured.

You should be fine from there, then add your htaccess redirect -- skip the wp-config rules since all will work fine with the url set correctly in the database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.