(Update. I rephrased the title since I understood better meanwhile what was going on.)

Dealing with an attempt to understand HTTPS redirection, I ended up seeing with a massive grep -r 'FORCE_SSL_ADMIN' ./www, this piece of code in default-constant.php (Wordpress 5.7.2, line 328):

function wp_ssl_constants() {
     * @since 2.6.0
    if ( ! defined( 'FORCE_SSL_ADMIN' ) ) {
        if ( 'https' === parse_url( get_option( 'siteurl' ), PHP_URL_SCHEME ) ) {
            define( 'FORCE_SSL_ADMIN', true );
        } else {
            define( 'FORCE_SSL_ADMIN', false );
    /* [...] */

If I understand correctly, if the constant isn't set and the siteurl entry (apparently the URL site value set in Setting page of the dashboard) begins is of scheme HTTPS://, then FORCE_SSL_ADMIN is set to true.

Is this default behavior (redirection according to the site URL scheme) explained somewhere in the official documentation?

  • Not at first glance, no - force_ssl_admin() links here for FORCE_SSL_ADMIN but it's not spelled out there. – Rup May 14 at 9:20
  • But I don't think this is surprising behaviour, is it? If we expect the site to be served over HTTPS then the admin pages should too, shouldn't they? – Rup May 14 at 9:20
  • @Rup Yes, you may be right. – Amessihel May 14 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.