Posts

Choose one canonical WordPress hostname, make both variants valid over TLS, and redirect the alternate directly while preserving paths and query strings.

When TLS ends at a proxy, WordPress must receive a trustworthy record of the original scheme. Fix proxy headers, URL generation, cookies, and redirects without accepting spoofed input.

Secure WordPress login and administration with valid HTTPS, correct proxy detection, and FORCE_SSL_ADMIN. Avoid redirect loops and preserve a recovery route.

HSTS preload removes the first insecure visit but commits an entire domain namespace to HTTPS. Review every subdomain, owner, and recovery path before submitting.

HSTS makes browsers use HTTPS for a cached period and can lock out unprepared subdomains. Roll it out gradually only after HTTPS and certificate renewal are reliable.

Flexible SSL can make Cloudflare request HTTP from an origin that insists on HTTPS, creating an endless loop. Move to authenticated origin HTTPS and choose one redirect owner.

A certificate name mismatch happens before WordPress can redirect the request. Check SAN coverage, DNS, SNI, and certificate bindings for every supported hostname.

A TLS handshake failure occurs before WordPress receives an HTTP request. Use the alert and handshake details to locate the incompatible client, edge, or origin setting.

An expired WordPress certificate may have been renewed without being deployed. Identify the certificate visitors receive, replace it safely, and repair renewal.

Install SSL for WordPress in the correct order: issue a certificate for every hostname, bind the full chain at the public endpoint, verify HTTPS, then update WordPress URLs and redirects.