6

I'm using Wordpress in a NginX server proxying to an apache server which serves the pages. Recently we wanted to force the use of SSL at least in the Admin section, so we installed the Wordpress HTTPS plugin. The server sections in NginX are properly configured, but when I activate the "Force SSL for admin" option I fall on a redirect loop.

I don't think that it's a cookie issue. If you need more info, I'll pass it to you.

3 Answers 3

5

I recently struggled with a similar issue, so I'll offer a couple of additional pieces of information for people who search for this question.

  1. The first step you should take when trying to force SSL for Admin of your site is to follow the directions in the codex . This means defining the FORCE_SSL_ADMIN option in your wp-config.php file.
  2. Be sure to take note of the warning in the codex that this edit needs to be above the /* That's all, stop editing! Happy blogging. */ line.
  3. There are many possible reasons why this could give you a redirect loop, but they all boil down the fact that Wordpress' is_ssl() function is returning false. For example, you may be running behind a reverse proxy that is doing SSL offloading. If that's the case, then your users enter https://yourwordpresssite, but the SSL offloader handles the decryption and by the time your server receives the request, the request is no longer SSL, and your server sees http://yourwordpresssite. If you're stuck here, again the codex has good advice, assuming your reverse proxy is properly configured. See the instructions here: (http://codex.wordpress.org/Administration_Over_SSL#Using_a_Reverse_Proxy).

If that still doesn't work, then your reverse proxy may not be setting the HTTP_X_FORWARDED_PROTO header. Unfortunately, none of this stuff is standardized, and there's more than one way to indicate that SSL offloading has taken place. The way used by our load balancer (Citrix Netscaler) is with the header Microsoft created called Front-End-Https. You can see this header as one of the common non-standard response headers listed on wikipedia here: (http://en.wikipedia.org/wiki/List_of_HTTP_header_fields#Common_non-standard_response_headers). Note that by the time your server sees this header, it will look like HTTP_FRONT_END_HTTPS. Note also that Netscaler doesn't send this header by default -- you have to configure it to add the header. This is documented here, and there's a nice video demo of how to do it here.

In the end, because we're doing our entire site with HTTPS only, I elected to use the wordpress-https plugin, which does a good job of handling edge cases (like other wordpress plugins that have hard coded http:// URLs that will cause warnings on your secure pages). I patched the plugin to recognize the HTTP_FRONT_END_HTTPS header and am submitting a patch to the author, so at some point this should be support by that plugin.

Good luck!

3
  • 2
    I created a test page with print_r($_SERVER); to see what HTTPS variables were set. I found both HTTPS and HTTP_X_FORWARDED_PROTO were not set properly, so I fixed that in NGINX and no more redirect loop!
    – Justin
    Commented Oct 2, 2013 at 22:38
  • 1
    Thanks for the writeup, very helpful! I found it worth throwing a print_r( $_SERVER ); return; into your wp_config.php for a quick glance at what your server is seeing. If there is no indication of https in what you see, then your proxy is the problem!
    – Anson Kao
    Commented May 28, 2014 at 21:30
  • 1
    Great tips! I encountered the same problem, googled a lot, and finally this answer fixed the issue.
    – Mine
    Commented Sep 11, 2014 at 8:20
1

The check for is_ssl() is not really the best in WP. You can take this mu-plugin to get a better check. Then simply stick tight to the recommendations of the codex.

Ad the Wordpress HTTPS-Plugin) I wouldn't count too much on this plugin when I look at trunk...

Mu-Plugins

MU-Plugins in Codex

10
  • So... should I take the is_ssl.php file and install it where? Commented Mar 15, 2012 at 18:04
  • just drop it into your mu-plugins folder. It's activated automagically. You can then use the provided template tags (see bottom of the file) everywhere.
    – kaiser
    Commented Mar 15, 2012 at 18:24
  • I don't have a folder called like that in my WP installation. Commented Mar 15, 2012 at 19:02
  • Just add it in your wp-content folder.
    – kaiser
    Commented Mar 15, 2012 at 20:02
  • Nope. Still doesn't work :( Commented Mar 16, 2012 at 14:49
-3

I solved this issue for me, by going into the site's CDN (Cloudflare) and setting the SSL mode to 'full'

Previously it was on 'flexible' which I suppose was causing or allowing the mix of http and https requests.

Even though I had the CDN on 'developer' mode (which I thought stopped the CDN from affecting the site), while I was troubleshooting this issue, the SSL setting still had an affect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.