I have a Wordpress theme I'm attempting to put on an SSL-only website. There is no non-SSL version of the site.

The Wordpress theme uses various functions like bloginfo('pingback_url'), bloginfo('template_directory'), get_template_directory_uri(), etc... All the typical functions for a theme.

All of these functions generate http links, not https, so therefore none of them load, since a non-SSL version of the site does not exist.

How do I force Wordpress to use https for EVERYTHING?

  • 2
    Link? Those functions should be returning https URLs if you have your site address set to https. How are you telling your site to use SSL?
    – webaware
    Jan 16 '13 at 23:58
  • Also note: similar problem being reported here, will update with an answer if I get one.
    – webaware
    Jan 31 '13 at 5:23

try installing this WordPress plugin. http://wordpress.org/extend/plugins/wordpress-https/installation/ but do read the installation instructions as it has some extra things to do after activating the plugin.


If your website is on a load-balancing service that handles SSL, then your server might not be getting anything in the server variable $_SERVER['HTTPS'], and $_SERVER['SERVER_PORT'] might be 80 when it should be 443 (see this Stack Overflow answer for details).

If this is the case, and you can't get your host to change that, then you might need to fudge it and tell PHP that it's SSL anyway. Set your home and site URLs to use https, so that all URLs generated by WordPress come out as https URLs. Then drop this code into a plugin (here's a ready-made one, drop it into your plugins folder and activate it):

// if site is set to run on SSL, then force-enable SSL detection!
if (stripos(get_option('siteurl'), 'https://') === 0) {
    $_SERVER['HTTPS'] = 'on';

NB: this can backfire on you, because you probably have code (in plugins or your own code) that checks to see if the page was loaded via SSL, and redirects if it wasn't. Your server won't be able to test this now! As such, you should also add some JavaScript to your page so that there's some level of assurance that your secure pages will be loaded via SSL (this is also done by the ready-made plugin):

if (document.location.protocol != "https:") {
    document.location = document.URL.replace(/^http:/i, "https:");

NB: this isn't foolproof! However, it should catch most situations, an exception being someone who disables JavaScript and then edits the URL to force it back to http. If they do that, they maybe deserve to have their credit card credentials sold to Elbonia.

  • 3
    I just wanted to add to this. I was having a similiar problem where the URL would show up as HTTPS, but WordPress displayed the scripts and style URLs with HTTP and not HTTPS (which causes them not to load because browsers don't allow websites to mixed with HTTP and HTTPS). The reason for this problem was I'm using CloudFlare's Flexible SSL and the connection between the user and CloudFlare is secure but the connection between CloudFlare and the webserver is not secure (thus Wordpress thinks HTTPS is disabled). Setting $_SERVER['HTTPS'] to on fixes this problem.
    – ub3rst4r
    Feb 3 '15 at 0:34
  • As an extra note, I have installed wp command line tool from electrictoolbox.com/… to enable the plugin.
    – BTR Naidu
    Apr 20 '16 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.