My site thinks it’s secure when it is fact not

wp_config was set up to force SSL by overwriting $_SERVER[‘HTTPS’], I respolved the issue.

I assume someone was trying to make SSL work behind the proxy at one point.

It would actually be a much better solution ( specifically for asset links ) to use the double slash //

Related Posts:

  1. SSL Error: unable to get local issuer certificate
  2. Is there a way to force ssl on certain pages
  3. Specific Page/Post Need to Stay Non SSL
  4. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
  5. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
  6. How to redirect all HTTP requests to HTTPS
  7. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site?
  8. Error `sec_error_revoked_certificate` when viewed in Firefox only
  9. How can I make uploaded images in the editor load with HTTPS?
  10. Any any insecure http:// URLs left in wordpress?
  11. HSTS header not being added correctly
  12. FORCE_SSL_ADMIN affecting subdomains
  13. What’s the best approach for generating a new API key?
  14. Simplest two-way encryption using PHP
  15. How do you redirect HTTPS to HTTP?
  16. Python requests SSL error – certificate verify failed
  17. How does the SQL injection from the “Bobby Tables” XKCD comic work?
  18. how fix “this certificate cannot be verified up to a trusted certification authority”
  19. How can I force users to access my page over HTTPS instead of HTTP?
  20. How can bcrypt have built-in salts?
  21. Getting a List of Currently Available Roles on a WordPress Site?
  22. Setting $_SERVER[‘HTTPS’]=’on’ prevents access to wp-admin
  23. How safe / sanitized is wp_insert_posts()?
  24. From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
  25. Why is WordPress redirecting from http to https on a local environment?
  26. Why are passwords exportable as plain text in WordPress?
  27. What is the purpose of having a token in cookies?
  28. How to remove “Connection Information” requirement on localhost install of WP on MACOSX
  29. How is password strength calculated?
  30. Regular security checks – what steps should be included?
  31. How to use WordPress multisite with mixed HTTP and HTTPS sites?
  32. What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
  33. Do Cookies Need to be Sanatized Before Being Saved?
  34. Disable external access to REST API Endpoint
  35. What is the wp-includes/certificates/ca-bundle.crt used for?
  36. Do you need to escape hard coded plain text?
  37. Encrypt emails?
  38. WordPress salts set in config and database
  39. How to redirect url requests to https? [closed]
  40. Disallow file edit not preventing plugin install
  41. How to secure WordPress XMLRPC?
  42. How can I find security hole in my wordpress site?
  43. Does WP show me if I’m logged in from multiple locations?
  44. HTTP Security Headers in wp-config
  45. WordPress Malware Problem help! [duplicate]
  46. Mixed Content with SSL, wordpress behind a reverse proxy
  47. Restrictive File Permissions
  48. Why are xmlrpc.php and wp-cron.php being called so often?
  49. Using esc_html with HTML purifier and CSSTidy: Overkill?
  50. wordfence scan warning on W3 Total Cache [closed]
  51. Securing a multi-user permission structure
  52. Divert http to https with WordPress on IIS
  53. FORCE_SSL_ADMIN not working
  54. wp-config.php modified?
  55. What’s the point of forbidding access to wp-config.php?
  56. How to save iframe tag into a post?
  57. What is the right way to redirect all traffic to HTTPS?
  58. HTTP sitewide, except for: wp-admin, and 2 custom directories
  59. wp-cli command throws error : “SSL routines:tls_process_server_certificate:certificate verify failed” while querying https website
  60. Htaccess file isn’t redirecting http sub-pages to https––they display 404 error instead, tried many solutions and none work
  61. I could not access my website wp-admin after installing SSL. And error with mixed content
  62. Is wp_kses the right approach in sanitizing this string?
  63. Renaming install.php for security?
  64. WordPress Front end Form – Enable to Submit PHP Codes
  65. Permalinks 404 error with HTTPS host
  66. ReDirect subfolder link to another sub-folder and force SSL
  67. Which Versions of WordPress Ship with the Patched TimThumb?
  68. All content is HTTPS, but browsers warn of HTTP mixed content [closed]
  69. Facebook og:image issues after https change [closed]
  70. Use global variables or function that returns said variables for site-wide private-ish WP settings?
  71. How do I handle SSL properly when WP is behind a reverse proxy?
  72. Hi do I change Media files that still show as http after installing ssl
  73. How safe is current_user_can()?
  74. Use Google authentication for pages within a website [closed]
  75. Side effects of disallowing *.php requests in production environment?
  76. should I escape a literal url added in functions.php
  77. WordPress CSS/Theme gone after SSL got activated
  78. Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
  79. Replace domain in database
  80. Adding Security Keys?
  81. Secret keys in SCM
  82. Uploading attachment (pdf) and prevent download for anonymous user
  83. How to move my local wordpress to https?
  84. Scan multiple websites for malware that are in same webhost root?
  85. Mixed Content: The page at ” was loaded over HTTPS, but requested an insecure font ”
  86. Since moving HTTPS using cloudflare, the admin and login pages no longer work
  87. Security: AWS (shared hosting) claims template file malicious
  88. 404 Page not found error after adding ‘s’ in ‘http’ in Settings
  89. Forcing SSL (Bad Theme coding)
  90. Moving site from HTTP to HTTPS
  91. How do I hide WordPress users from security scanning?
  92. Background Updates Not Happening
  93. wp-config.php file and code injection
  94. What is the best security $_POST method?
  95. Is WordPress ready for GDPR compliance? [closed]
  96. Move data from wp-config to another file
  97. Heartbleed: What is it and what are options to mitigate it?
  98. OpenVPN vs. IPsec – Pros and cons, what to use?
  99. Remove “www” and redirect to “https” with nginx
  100. Https Website: CSS and JS files load in http and admin page does not load too