Thanks for this suggestion @jtittle, it’s done the trick.

@hansen

Even when setting the URL’s to use HTTPS and further enforcing it via definition of constants, it seems that WordPress still doesn’t seem to handle proxied connections correctly (and by that, I mean it doesn’t seem to check what’s being sent).

I ran in to this last week when configuring NGINX as a Load Balancer with a full proxy config. I’d think this should pretty well cover just about anything in most all cases:

        proxy_buffers 16 32k;
        proxy_buffer_size 64k;
        proxy_busy_buffers_size 128k;
        proxy_cache_bypass $http_pragma $http_authorization;
        proxy_connect_timeout 59s;
        proxy_hide_header X-Powered-By;
        proxy_http_version 1.1;
        proxy_ignore_headers Cache-Control Expires;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_404;
        proxy_no_cache $http_pragma $http_authorization;
        proxy_pass_header Set-Cookie;
        proxy_read_timeout 600;
        proxy_redirect off;
        proxy_send_timeout 600;
        proxy_temp_file_write_size 64k;
        proxy_set_header Accept-Encoding '';
        proxy_set_header Cookie $http_cookie;
        proxy_set_header Host $host;
        proxy_set_header Proxy '';
        proxy_set_header Referer $http_referer;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Original-Request $request_uri;

Unfortunately, it doesn’t. Even though the correct headers are being sent through, WordPress still needs a little modification (using the code I posted above) to get things working properly.

I’m guessing this is because SSL is terminating on the LB, thus since SSL isn’t enabled on the actual endpoint where the request lands, WordPress continues to identify with Port 80, thus all resources are served over HTTP instead of HTTPS.

From what I’ve read, they aren’t going to add additional checks as it’s the responsibility of the user or sysadmin to account for these things, even though under normal circumstances, any script should account for them.