WordPress behind a reverse proxy/ssl endpoint, slightly borked

Quite a simple fix with WP-CLI:

wp search-replace 'https://example.org' 'https://example.org'

Add --network if running multisite. Add --dry-run if you’re unsure. Backup before running. More here: https://wp-cli.org/commands/search-replace/

This will also update your siteurl and home settings, and thus fix all your forms with an http action too.

Re. site breakage, if it breaks, go watch your error logs and see what exactly is broken before restoring from backup. Then at least you’ll know what to fix.

I did visit the error logs. They had nothing terribly diagnostic in them.

I just tried the search-replace thing and it did the trick. Thank you very much!

You’re welcome ??

I want to do the same thing with my site, i.e run it on https behind nginx proxy.
Could you please post the complete nginx config file for your blog?

Let’s see if I can unpick the portions that are related to my blog. It should be fairly obvious where you have to sub in your own data (‘your-ip-address-here’, etc, but not $host or things like that) but make sure you read through the whole thing or it definitely won’t work when you start it. ??

# What username you want to run under
user  www;
worker_processes  1;

# If you use this you'll have to create /var/log/nginx
error_log  /var/log/nginx/error.log;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
    # don't forget log rotation if you do this on an active site! Or you can just disable
    # the access log entirely.

    keepalive_timeout  65;

    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;  # don’t use SSLv3 ref: POODLE

    # directive for forwarding port 80 requests to ssl
    server {
        listen       your-ip-address-here:80;
        # server_name may not be necessary? Dunno, since performance is not an issue
        # for my port 80 forwarding I never bothered to find out
        server_name  ~.*;

        return 301 https://$host$request_uri;
    }

    server {
        listen your-ip-address-here:443;
        server_name yourservername.com www.yourservername.com;
        # or whatever list of servernames you like. Make sure that the ssl certificate
        # applies to all of them. If you need a separate ssl certificate you'll need a
        # separate 'server' directive, but it can be more or less identical to this one.

        ssl on;
        ssl_certificate /path/to/your/server/cert/file.crt;
        ssl_certificate_key /path/to/your/server/key/file.key;

        add_header Strict-Transport-Security max-age=15768000;

        location / {
            # NOTE: You probably won't need this, I just put it in to keep these guys from
            # stealing oodles of my bandwidth to scum their way to the top of google image
            # search using my photos.
            if ($http_referer ~* (becuo|m5x\.eu|galleryhip|pixshark|imgkid|imgarcade|thoughtyoumayask) ) {
                return 403;
            }

            # This can be a domain name, an internal IP address, or your local IP with a
            # different port number.
            proxy_pass https://address-to-forward-requests-to:port-number;
            # If you have people uploading stuff, set this to the largest size you think
            # should be allowed. If not, you can set it much smaller than 20M, 1 or 2 maybe
            client_max_body_size 20M;

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            proxy_set_header X-Forwarded-Proto https;

            proxy_redirect off;

            proxy_buffers 64 4k;
        }
    }

    # put any other server directives for any other server names you're running in here.
    # note that even with only a single IP address this lets you use https for all your
    # servers, using TLS SNI. Or you can just use multiple external ips to listen on.

}