Hot answers tagged

103

You've added $_SERVER['HTTPS'] = 'on'; to your wp-config.php? You should also use the WP Migrate DB plugin to migrate from http://yoursite.com to https://yoursite.com


54

I had a similar problem and just added the following snippet to my wp-config.php: /** SSL */ define('FORCE_SSL_ADMIN', true); // in some setups HTTP_X_FORWARDED_PROTO might contain // a comma-separated list e.g. http,https // so check for https existence if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false) $_SERVER['HTTPS']='on'...


37

For the login part, this works for me ... Paste the following line in your wp-config.php if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') $_SERVER['HTTPS']='on'; but make sure that you do it before the following line require_once(ABSPATH . 'wp-settings.php'); By doing so you can get your admin panel back ... See details here Also to avoid getting ...


24

TL;DR: Yes, remove that setting as of WordPress 3.7 or later. In the past, many people added the sslverify=false parameter specifically because their installation of PHP was unable to properly verify the certificate. Typically, this was because the PHP install had not been updated with the latest copy of the CA Root Certificates. The root certs change ...


19

Special thanks to user42826. According to the codex: If WordPress is hosted behind a reverse proxy that provides SSL, but is hosted itself without SSL, these options will initially send any requests into an infinite redirect loop. To avoid this, you may configure WordPress to recognize the HTTP_X_FORWARDED_PROTO header (assuming you have properly ...


12

As I do not have the comment privilege yet, I will post this addition as another answer: The solution proposed by Elias, to add the following to wp-config.php, did the trick for me: /** SSL */ define('FORCE_SSL_ADMIN', true); // in some setups HTTP_X_FORWARDED_PROTO might contain // a comma-separated list e.g. http,https // so check for https ...


11

New workflow, since the Admin SSL plugin is not supported. use the Plugin WP https See the settings If you want SSL for wp-admin, add this to the wp-config.php: define( 'FORCE_SSL_ADMIN', TRUE ); If you want also SSL for the log in page, add this to the wp-config.php define( 'FORCE_SSL_LOGIN', TRUE ); Add the follow line to the .htaccess; remove the ...


11

There are tons of reasons that can let a SSL verification fail. Starting from too many redirects to wrong .ini files/setups or simply missing certificates or sub domains. In any case, you will need to search the reason for that and fix it. There is no way around it. But to temporarily work around that problem (let's say you need to develop your code further ...


8

You can't -- URLs must have a protocol for WordPress to enqueue them. What you can do, though, is detect which protocol to use and then use that. $protocol = is_ssl() ? 'https' : 'http'; $url = "$protocol://example.com/resource"; But for enqueuing scripts from your theme, you should use get_template_directory_uri() or get_stylesheet_directory_uri() which ...


8

The code you provided could cause issues with 3rd party URLs in hyperlinks not running https. You can fix this by including your home url, e.g: $content = str_replace( set_url_scheme( home_url(), 'http' ), set_url_scheme( home_url(), 'relative' ), $content); Next, you're applying this when you'd like to display the content, which means you need to do an ...


8

Check your wp-config.php file for lines like: define( 'WP_SITEURL', 'https://example.com' ); define( 'WP_HOME', 'https://example.com' ); Also check your database's {prefix}_options table: SELECT * FROM wp_options WHERE option_name='siteurl' OR option_name='home'; ...assuming that your database's prefix is wp_.


8

There's not a correct order. Either way will work and results in a WordPress install that is secured with SSL. What makes sense in a situation, depends on the setup and workflow. If you can plan ahead, it's optimal to set up the SSL on your server first. Because doing so, you don't have to go back through WordPress, and change settings and the database. In ...


7

A simple check for is_ssl() should do it: add_action( 'plugins_loaded', 'wpse_2718_force_ssl' ); function wpse_2718_force_ssl() { if ( is_ssl() ) return; wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] ); exit; } But I would do this in .htaccess to catch images too: RewriteEngine On RewriteCond %...


7

I don't know if this will help or not, but worth a try. Create a Must Use plugin and drop this lines, see code comments: <?php /* Plugin Name: Network upgrade exception */ // Run only in the Upgrade screen add_action( 'load-upgrade.php', 'add_filter_wpse_115279' ); function add_filter_wpse_115279() { add_filter( 'http_request_args', '...


7

Another version for the books, just add this to the top of wp-config.php Reason is that there could be load balancers or something that does not pass along the proper https value, so you have to grab it from elsewhere and fake it for wordpress. if ( (isset($_SERVER['HTTP_X_FORWARDED_PORT'] ) && ( '443' == $_SERVER['HTTP_X_FORWARDED_PORT'] )) || ...


6

my name is Daniel Kanchev and I work for SiteGround as a Senior Web Apps Engineer. The described issue is pretty strange and I just configured a test WordPress Network on one SiteGround shared server. I did not face any similar issues and I used sub-domain names with a wildcard SSL certificate. Usually such issues are caused by Apache VHost misconfiguration ...


6

Use the developer tools in Firefox (or Firebug) or Chrome or Safari or IE to see the errors with specific images. 1) You may need to change URLs of media items in the post/page content to https. Search RegEx is a good plugin to be able to search and replace (optionally with grep) through all posts, pages, excerpts, comments, titles and meta. And, ...


5

I recently struggled with a similar issue, so I'll offer a couple of additional pieces of information for people who search for this question. The first step you should take when trying to force SSL for Admin of your site is to follow the directions in the codex . This means defining the FORCE_SSL_ADMIN option in your wp-config.php file. Be sure to take ...


5

I don't believe WordPress sends HTTPS requests unless it has been told to do so. It sounds like you need to undo some previous configuration -- most likely change/remove the FORCE_SSL_LOGIN constant. You may have plugins participating as well though. Make sure to check that. Reference: http://codex.wordpress.org/Administration_Over_SSL


5

I had exactly the same problem and the solution for me was to add these lines to /etc/apache2/sites-enabled/default-ssl.conf, which is my SSL-enabled website's configuration file: <Directory /var/www/html/> AllowOverride All </Directory> Of course, this assumes DocumentRoot /var/www/html. Change accordingly if is ...


5

You'll need to update all of the URLs in your database to the HTTPS protocol: Go and download Interconnect IT's Database Search & Replace Script here Unzip the file and drop the folder where your WordPress is installed (the root) and rename the folder to replace (screenshot) Navigate to the new folder you created in your browser (ex: http://example.com/...


5

I just figured out the issue. You need to add the HTTPS/SSL settings before require_once(ABSPATH . 'wp-settings.php'); in your wp-config.php So the relevant part of your wp-config.php should look like this. define( 'FORCE_SSL_ADMIN', true ); // in some setups HTTP_X_FORWARDED_PROTO might contain // a comma-separated list e.g. http,https // so check for ...


4

Go to your WordPress General Settings and change the WordPress Address (URL) and the Site Address (URL) from HTTP to HTTPS. ps. And disable all the plugin breaking your site. If that doesn't fix this there is a proper guide here and several steps you can take: https://managewp.com/wordpress-ssl-settings-and-how-to-resolve-mixed-content-warnings


4

Do you have to have secure.domain.com function or can it redirect? The tl;dr is that you don't. The primary domain is the cheese: it stands alone. However.... You can use .htaccess to check 'If someone is coming from secure.domain.com, send them to domain.com' RewriteCond %{HTTP_HOST} ^secure\.domain\.com RewriteRule ^(.*) http://domain.com/$1 [L,R=301] ...


4

Is it a best practice? Yes. What will be the behavior of plugins? They should work fine. What are the pros and cons of my decision? Pros: More secure. Cons: none. http://codex.wordpress.org/Administration_Over_SSL


4

Installing the WordPress HTTPS plugin should take care of it.


4

First, rename the folder wp-content/plugins/wordpress-https to wp-content/plugins/wordpress-https-OFF so that WordPress can't find it to run it. Second, add the following lines to your wp-config.php file, replacing the domain name with your domain name: define( 'WP_SITEURL', 'http://example.com/' ); define( 'WP_HOME', 'http://example.com/' );


4

This is a late answer but this works for me: Change the RewriteCond to this RewriteCond %{HTTP:X-Forwarded-Proto} !https Should be like this: RewriteEngine On RewriteCond %{HTTP:X-Forwarded-Proto} !https RewriteRule ^(.*)$ https://yourdomain.com/$1 [R,L]


4

WordPress can rely on underlying server software (typically cURL) to perform network request. In a nutshell because it's what that software is good and is there for. On some servers due to various reasons (I had never bothered looking into myself) it is quite typical for server software to not be able to "verify" secure connections, producing said errors. ...


4

After a little more reading via the WordPress Codex, I discovered that I was calling the favicon incorrectly. It should be called like this: <link rel="shortcut icon" href="<?php echo get_stylesheet_directory_uri(); ?>/favicon.ico" /> Using get_stylesheet_directory_uri() checks for SSL.


Only top voted, non community-wiki answers of a minimum length are eligible