0

I facing an issue. I installed WordPress on a Ubuntu server.

Though both site_url and home_url are with https, WordPress keeps loading files via http. This blocks me when trying to login (login form action is http too) and also loads assets via http and I get Warnings in browser console. The server is configured by third party and it redirects to https.

I used:

define( 'WP_HOME', 'https://sitename.com' );
define( 'WP_SITEURL', 'https://sitename.com' );
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)
       $_SERVER['HTTPS']='on';

With these two I receive to many redirects on wp-admin.


The only thing that worked (at least to log in) was:

if($_SERVER['PHP_SELF']=="/index.php")
{
define('WP_HOME','https://sitename.com');
define('WP_SITEURL','https://sitename.com');
}
else
{
define('WP_HOME','http://sitename.com');
define('WP_SITEURL','http://sitename.com');
}

But this is not a solution, cause my site will load assets via http... I searched and tested solutions from here and other sites, but none of them seems to work.

  • 1
    What is in your .htaccess file? Could be worth adding this at the top: RewriteEngine On RewriteCond %{HTTPS} !=on RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE] – TomC Feb 16 at 19:35
  • Thanks, Tom. The problem persists... – Akil Feb 17 at 20:42
0

@Tomc 's solution is a great start. Here it is formatted (you can't format things in a comment).

RewriteEngine On 
RewriteCond %{HTTPS} !=on 
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]

In addition, I'm not a fan of setting URLs in the configuration files. Best (IMHO) to set those two values in the wp-options table.

You might need to look at the entire database to ensure that all references to internal assets (especially media) is set to https . There are several plugins that allow you to search (and replace) items in the database - my go-to is the "Better Search and Replace" plugin.

You can use the Developer tools in your browser (usually F12) to see all requests, and find those that are not https.

Added

Here's a rewrite rule for forcing SSL, plus WordPress basic. Change domain name to match yours.

 RewriteEngine On 
    RewriteCond %{HTTPS} !=on 
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
| improve this answer | |
  • Thanks, Rick! This is inside my htacces RewriteEngine On RewriteCond %{HTTPS} !=on RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE] <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] </IfModule>. The site has SSL, is redirected to https. Even with home and site_url set to https, it loads WordPress assets with http (and gives too many redirects if trying to access wp-admin). – Akil Feb 17 at 20:38
  • Have you tried a force refresh from your browser and deleted any cache in caching plugins in Wordpress or host? – TomC Feb 17 at 21:49
  • @Alki - try the htaccess in my edited answer. That will get you forced to SSL, plus the basic htaccess that WordPress needs. You may still need to search/replace inside the database, as I previously mentioned. Clearing cache is always a good idea; but you can accomplish that by testing with a private browser session. – Rick Hellewell Feb 18 at 0:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.