Title: FORCE_SSL_ADMIN and admin-ajax.php problem
Last modified: August 24, 2016

---

# FORCE_SSL_ADMIN and admin-ajax.php problem

 *  [dfisek](https://wordpress.org/support/users/dfisek/)
 * (@dfisek)
 * [11 years ago](https://wordpress.org/support/topic/force_ssl_admin-and-admin-ajaxphp-problem/)
 * When using FORCE_SSL_ADMIN with an untrusted SSL certificate, I’m having problems
   with some plugins (ie: wp-polls) using admin-ajax.php.
 * WordPress itself doesn’t force admin-ajax.php to SSL, since it’s used by non-
   admin code as well.
 * However the plugins use the admin_url() function to form the admin-ajax.php URL.
   The function returns a URL that will be served via https.
 * At that time we have a mixed content, where the rest of the site is served through
   http and the admin-ajax.php is served through https. If the site doesn’t have
   a SSL certificate that is trusted, the browser’s default behavior is to block
   that https connection thus breaking the ajax function.
 * Since many WordPress sites doesn’t have public user registration, it’s common
   practice to use self-signed SSL certs with such WordPress sites.
 * A dirty hack could be using a home_url(‘wp-admin/admin-ajax.php’) function instead
   but that would defeat the whole purpose of an admin_url() function.
 * What solution should be implemented for this problem?

Viewing 2 replies - 1 through 2 (of 2 total)

 *  [TruthMerchant](https://wordpress.org/support/users/truthmerchant/)
 * (@truthmerchant)
 * [10 years, 6 months ago](https://wordpress.org/support/topic/force_ssl_admin-and-admin-ajaxphp-problem/#post-6149904)
 * When 4.0 deprecated “FORCE_SSL_LOGIN” it broke a lot of public facing plugins
   that use AJAX. If the plugin is using
    “admin_url(‘admin-ajax.php), relying on
   this function to properly define the protocol. then the ‘https” protocol will
   be asserted causing the AJAX to fail to send COOKIES (authorizations). It fails
   because the page that sent the AJAX object was operating as “http” and the browser
   sees the ‘https’ AJAX request back to the page as being “cross domain”.
 * For now…..
 * so… in the plugin:
 * use `$scheme = is_ssl() ? 'https' : 'http';` //define proper protocol
 * ,and
 * `admin_url(admin-ajax.php,$scheme)`, // specify the protocol
 * IMHO there should probably be a core function named “ajax_url(…)” that handles
   this problem and also uses a “nonce” with the time being part of the arguments.
 *  [janrenn](https://wordpress.org/support/users/janrenn/)
 * (@janrenn)
 * [10 years, 2 months ago](https://wordpress.org/support/topic/force_ssl_admin-and-admin-ajaxphp-problem/#post-6149917)
 * use `admin_url` filter [https://github.com/lesterchan/wp-postratings/issues/75](https://github.com/lesterchan/wp-postratings/issues/75)

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘FORCE_SSL_ADMIN and admin-ajax.php problem’ is closed to new replies.

## Tags

 * [ajax](https://wordpress.org/support/topic-tag/ajax/)
 * [SSL](https://wordpress.org/support/topic-tag/ssl/)

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 2 replies
 * 3 participants
 * Last reply from: [janrenn](https://wordpress.org/support/users/janrenn/)
 * Last activity: [10 years, 2 months ago](https://wordpress.org/support/topic/force_ssl_admin-and-admin-ajaxphp-problem/#post-6149917)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics