I am installing wordpress 6.2 and this is my install screen

enter image description here

as you can see there is something wrong, then I realised what it is

enter image description here

when you look at the source wordpress is (correctly) working out the server is only http: which technically it is, but this is just a LAN server behind a gateway In reality this gateway machine handles the ssl and certs and forwards it to port 80 via nginx reverse proxy.

This means that the worpdress site "thinks" it's internal references are all on on http: but actually the links will NOT work unless they are https: because the gateway won't forward them

How do I fx it so that the source says

<link rel='stylesheet' id='buttons-css' href='https://SOMEMADEUPDOMAIN.com/wp-includes/css/buttons.min.css?ver=6.2' type='text/css' media='all' />
<link rel='stylesheet' id='forms-css' href='https://SOMEMADEUPDOMAIN.com/wp-admin/css/forms.min.css?ver=6.2' type='text/css' media='all' />
<link rel='stylesheet' id='l10n-css' href='https://SOMEMADEUPDOMAIN.com/wp-admin/css/l10n.min.css?ver=6.2' type='text/css' media='all' />
<link rel='stylesheet' id='install-css' href='https://SOMEMADEUPDOMAIN.com/wp-admin/css/install.min.css?ver=6.2' type='text/css' media='all' />

PS: I have tried adding

define('FORCE_SSL_ADMIN', true);
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false ) {
   $_SERVER['HTTPS'] = 'on';

towards the bottom of wp-config.php but it's having none of it

  • have you tried using HTTPS all the way instead of terminating it at your proxy? This sounds like a proxy issue. Also FORCE_SSL_ADMIN is for admin, but your screenshot shows an installer page
    – Tom J Nowell
    May 4, 2023 at 16:09
  • What are home and siteurl set to in your database's {$prefix}options table? If they're set to http://example.com, change them to https://example.com.
    – Pat J
    May 4, 2023 at 16:11
  • @PatJ I'm still at the install stage, it isn't referencing the db yet
    – Mr Heelis
    May 4, 2023 at 16:12
  • @TomJNowell if you terminate the internal server at ssl you're adding a layer of self signing that is totally unneeded. It's the wrong solution
    – Mr Heelis
    May 4, 2023 at 16:21
  • I see you have HTTP_X_FORWARDED_PROTO but have you confirmed that it is indeed present and set? How is your proxy implemented? Doing this is possible without modifying WP core
    – Tom J Nowell
    May 4, 2023 at 17:31

2 Answers 2


You need to let wordpress know, it was accessed via https using the X-Forwarded-Proto http header.

I have the following in my nginx (=proxy) config

    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;

I have a fix, I am not happy with it but it works:

I added define('FORCE_SSL_ADMIN', true); to wp-config.php

Then I changed this method is_ssl() in /wp-includes/load.php to this. I think to avoid this bug, the define('FORCE_SSL_ADMIN', true); check should have be used by the developers.

I added the line if( defined( FORCE_SSL_ADMIN ) ) return FORCE_SSL_ADMIN;

 * Determines if SSL is used.
 * @since 2.6.0
 * @since 4.6.0 Moved from functions.php to load.php.
 * @return bool True if SSL, otherwise false.
function is_ssl() {
    if( defined( FORCE_SSL_ADMIN ) ) return FORCE_SSL_ADMIN;
    if ( isset( $_SERVER['HTTPS'] ) ) {
        if ( 'on' === strtolower( $_SERVER['HTTPS'] ) ) {
            return true;

        if ( '1' == $_SERVER['HTTPS'] ) {
            return true;
    } elseif ( isset( $_SERVER['SERVER_PORT'] ) && ( '443' == $_SERVER['SERVER_PORT'] ) ) {
        return true;
    return false;

PS: I think it is a bug because the code does not operate under a principle know as single source of truth

  • If you change core code, you will lose your changes at the next WP core update. You need to re-think your solution (which is currently over my head) to not having changes to WP core code. May 4, 2023 at 18:37
  • @RickHellewell yes it's not ideal to patch it, but the alternative is a dead website I'll submit it as a bug
    – Mr Heelis
    May 4, 2023 at 19:03
  • @RickHellewell my change means that the actual defined value FORCE_SSL_ADMIN is used whether or not it "self detects" http, which is I think ) how it should work based on it being optional, and it having the name: FORCE
    – Mr Heelis
    May 4, 2023 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.