WordPress wp-admin https redirect loop

You've added $_SERVER['HTTPS'] = 'on'; to your wp-config.php?

You should also use the WP Migrate DB plugin to migrate from http://yoursite.com to https://yoursite.com

I had a similar problem and just added the following snippet to my wp-config.php:

/** SSL */  
define('FORCE_SSL_ADMIN', true);  
// in some setups HTTP_X_FORWARDED_PROTO might contain  
// a comma-separated list e.g. http,https  
// so check for https existence  
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)  
    $_SERVER['HTTPS']='on';

as suggested in the Codex. This will only be needed in case there's SSL passthrough enabled in your load balancer (or firewall) setup. Meaning that while you can access the site via HTTP within TLS/SSL, the communication that your server receives is HTTP only. To account for that, above header is needed so WordPress can "set" HTTPS to on in the $_SERVER config array.

Configure CloudFlare to https only and in wp-config set

define('FORCE_SSL_ADMIN', false);
define('FORCE_SSL_LOGIN', false);

I ran into this same issue so after hours of research and tweaking things I got it to work. I'd share all I did because I'm not certain if they're all related.

First, I'm hosting my wordpress website on cpanel so I used the Softaculous tool on cpanel to upgrage my wordpress version.

Secondly, I upgraded my wordpress DB.

(I noticed that my .htaccess file in the root folder of my website was updated with an addition of RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] )

Then I checked the .htaccess file of my wp-admin folder then I saw these commands:

Order Allow,Deny
Deny from all

I went to read from the wordpress website that those commands are meant to prevent web access to files in that folder, but this wasn't a behaviour I needed (I think)

So I commented them out and I was able to load my admin section.

I had the same issue when I hosted my site on Azure webapp service Linux.

Try this plugin. take care when it active it works. https://wordpress.org/plugins/jsm-force-ssl/

This plugin uses native WordPress filters, instead of PHP’s output buffer, for maximum reliability, performance and caching compatibility (this plugin does not affect caching performance), along with 301 permanent redirects for best SEO (301 redirects are considered best for SEO when moving from HTTP to HTTPS).

Honors proxy / load-balancing variables for large hosting environments:

HTTP_X_FORWARDED_PROTO HTTP_X_FORWARDED_SSL Requirements:

Your web server must be configured with an SSL certificate and able to handle HTTPS request.

Simply activate the plugin and you’re done:

There are no plugin settings to adjust, and no changes are made to your WordPress configuration — simply activate or deactivate the plugin to enable / disable the filters and dynamic redirects.

5 year old Question...

Okay, I had this error, after installing my SSL Certificate and changing all links that were http to https using the wp-cli.phar found here.

I tried various configurations and none seemed to resolve this, unless I set this:

define('FORCE_SSL_ADMIN', true); 
define('FORCE_SSL_LOGIN', true);

to this:

define('FORCE_SSL_ADMIN', false);
define('FORCE_SSL_LOGIN', false);

It allowed me to hit the log-in page, but then was unable to actually log-in. I tried answer two but that unfortunately didn't help either, Untill I did the following change:

/** SSL */   
define('FORCE_SSL_ADMIN', true);
// in some setups HTTP_X_FORWARDED_PROTO might contain
// a comma-separated list e.g. http,https   
// so check for https existence   
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== true)  
     $_SERVER['HTTPS']='on';

For some reason, I do not know why - I had to change the

!== false

to

!== true

I'm running nginx as host and reverse proxy to nginx unit... If anyone has any idea why that worked, Please let me know

Actually... I had this issue and the solving was quite easy and embarassing. Somehow on the webhost my wp-admin folder was deleted and therefore no wp-admin with this same error message.

After hours of testing so many different ways I just saw this and when downloaded and uploaded again it all worked as normal.

Check it guys, it can be that simple.

As I do not have the comment privilege yet, I will post this addition as another answer:

The solution proposed by Elias, to add the following to wp-config.php, did the trick for me:

/** SSL */  
define('FORCE_SSL_ADMIN', true);  
// in some setups HTTP_X_FORWARDED_PROTO might contain  
// a comma-separated list e.g. http,https  
// so check for https existence  
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)  
    $_SERVER['HTTPS']='on';

However, it only worked for me when I put it before everything else in this file!

Another version for the books, just add this to the top of wp-config.php

Reason is that there could be load balancers or something that does not pass along the proper https value, so you have to grab it from elsewhere and fake it for wordpress.

if ( (isset($_SERVER['HTTP_X_FORWARDED_PORT'] ) && ( '443' == $_SERVER['HTTP_X_FORWARDED_PORT'] ))
    || (isset($_SERVER['HTTP_CF_VISITOR']) && $_SERVER['HTTP_CF_VISITOR'] == '{"scheme":"https"}')) {
    $_SERVER['HTTPS'] = 'on';
}