Correctly force SSL on wordpress via wp-config.php Correctly force SSL on wordpress via wp-config.php wordpress wordpress

Correctly force SSL on wordpress via wp-config.php


PHP code doesn't have to deal with SSL at all in such case. Here applies classical SoC principle: if you code doesn't explicitly work with connection (in WP it does not), you should leave protocol checking to web server.

You should also avoid defining port in your rewrite rules. In case you're not using multisite WP setup, you could try:

RewriteEngine OnRewriteCond %{HTTPS} offRewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]


i used this one. which is fine to go on.

if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')   $_SERVER['HTTPS']='on';

if your server port is differed from 443. you can specify it . Otherwise, no need to use it once again .


Corrected .htaccess rules (as detailed on wiki.apache.org):

RewriteEngine OnRewriteCond %{HTTPS} !=onRewriteRule ^/?(.*) https://mysslcertdomainname.com/$1 [R,L]

Normally, your code examples (1,2,3) are not necessary with Wordpress, but it looks like you have some kind of proxy based on the question.

  1. Not Good Will generate a PHP warning (standard php configuration) if HTTP_X_FORWARDED_PROTO is not set by the web server.
  2. Good Checks variable exists before checking the value. Generates no warnings.
  3. Good Best**

** As a general rule changing _SERVER variables (like SERVER_PORT and HTTPS) are discouraged unless you have a not-so-common setup (ie. behind proxy - which is the only reason for any of this code).