Https and Http Login Issue on Wordpress Multisite

Question

I have a Subdomain WordPress Installation

My multisite MAIN SITE is using a free C-panel SSL certificate but my subsites doesn't (My host doesn't allow free SSL for wildcard)

This is the issue: When I'm logged in on https, I am NOT automatically login on http or vice versa

Can anyone suggest a way to be able to automatically login on both https and http without login in again?

Answer 1

The problem is that when you log into the HTTPS site, WordPress sets the 'secure only' flag on the authentication cookie and so this cookie isn't sent to your HTTP-only sites. You can change this by overriding the secure_signon_cookie filter in a plugin or theme and returning false:

function no_secure_signon_cookie( $secure_cookie, $credentials ) {
    // Don't generate secure-only authentication cookies even on HTTPS
    return false;
}
add_filter( 'secure_signon_cookie', 'no_secure_signon_cookie', 10, 2 );

(Actually this might need to be in a mu-plugin: I'm not sure if normal plugins and themes are loaded for wp-login.)

But don't do this: fix up your subdomains to work over HTTPS, even if that means getting a separate free certificate that includes all the subdomains explicitly (provided you have enough control over the server to run certbot or similar yourself).

(That all said, I don't understand how you can log into an HTTP site and not be logged in over HTTPS, since multisites use the primary site for all logins and that will be the HTTPS one?)