0

Unable to remove 301 redirect for wordpress wp-admin on nginx. The homepage seems fine

I’ve tried almost everything

  • Disabling plugins by renaming the plugin directory
  • Removing the redirect_canoncial in functions.php
  • Even restored an ebs snapshot taken prior to change

The ouput for curl –I http://www.example.com/wp-admin is 301 moved permanently. I’m using cloudfront and my server default file below

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;

    # Add index.php to the list if you are using PHP
    index index.php index.html index.htm index.nginx-debian.html;

    server_name www.example.com;

    location / {
            # First attempt to serve request as file, then
            # as directory, then fall back to displaying a 404.
            #try_files $uri $uri/ =404;
            try_files $uri $uri/ /index.php?q=$uri&$args;
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
            include snippets/fastcgi-php.conf;

    #       # With php7.0-cgi alone:
    #       fastcgi_pass 127.0.0.1:9000;
    #       # With php7.0-fpm:
            fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
            deny all;
    }
}
  • did you try disabling all plugins at once? or in a serialized manner, i understand the repercussions involved on doing so, but just cross validating. – Corleone Aug 14 '18 at 9:31
  • i disabled them all at once by renaming the plugins directory – stack567 Aug 14 '18 at 9:33
  • alright, 1. have you validated the wp-config for any force redirects? 2. check the corresponding database for any redirect rules 3. where exactly is it getting redirected? – Corleone Aug 14 '18 at 9:43
  • There are no force redirects on wp-config. Also which table and filed do i check for the redirect rules on the db? – stack567 Aug 14 '18 at 9:49
  • well that depends, so could also let me know 3. where exactly is it getting redirected? like is it doing a http:// to https:// or is it landing on any distinct page or the home page itself – Corleone Aug 14 '18 at 9:55
1

This is a redirection to TLS i.e. Location: https://www.example.com/wp-admin. It isn't done in the server configuration, but in function auth_redirect(), found in wp-includes/pluggable.php lines 997-1064, more specifically in lines 1012-1020:

// If https is required and request is http, redirect
if ( $secure && !is_ssl() && false !== strpos($_SERVER['REQUEST_URI'], 'wp-admin') ) {
    if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {
        wp_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
        exit();
    } else {
        wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
        exit();
    }
}

This is controlled by force_ssl_admin(), enabled by adding define('FORCE_SSL_ADMIN', true); constant to wp-config.php. If the constant is not defined, it defaults to false unless the siteurl has https:// (see wp_ssl_constants() in wp-includes/default-constants.php lines 284-304).

Source code line numbers are from current WordPress 4.9.8 and may vary on future versions.

Admin & login page redirections to TLS are not harmful and you should have them enabled for security. Current best practice is to have all sites protected with TLS i.e. https://www.example.com/ as the siteurl.

  • I've added FORCE_SSL_ADMIN to wp-config.php and updated the siteurl on options table to https but i still receive the 301. Any reason why my ebs restore did not take things back to the pre 301 redirect state? – stack567 Aug 14 '18 at 10:43
  • Only define('FORCE_SSL_ADMIN', false); would disable the redirection, but that only solves the problem you think you have, actually causing more problems than it solves. – Esa Jokinen Aug 14 '18 at 10:48
  • i've just tried define('FORCE_SSL_ADMIN', false) and this hasn't stopped the redirection either – stack567 Aug 14 '18 at 11:01
  • Have you removed all cookies, too? The second test in auth_redirect() is whether the user has requested the site to have SSL enabled, and this information is saved in a cookie. – Esa Jokinen Aug 14 '18 at 11:04
  • But really: you should not try to disable TLS. You should try to enable it, instead. – Esa Jokinen Aug 14 '18 at 11:06
0

After much reading it looks like the issue is down to a conflict between the default nginx root which i discovered is /usr/share/nginx and the one modified under site-available/default root directive which reads /var/www/html.

Nginx was looking for a file /usr/share/nginx/html/wp-admin/index.html which did not exist. I created a wp-admin folder with an index.html in /usr/share/nginx which stopped the 301 redirection. I've since deleted both and the 301 did not return but then led to a 404 error which i fix by returning to the original site-available/default that came with nginx installation. Once i reloaded nginx things were fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.