Force HTTPS Where WordPress Credentials Matter Most
HTTPS encrypts communication between the visitor's browser and the web server. This is especially important around authentication because login requests contain credentials and administrative sessions provide access to sensitive website functionality.
Force SSL Admin lets you specifically enforce HTTPS around the WordPress dashboard and authentication screens. When someone attempts to open a protected area over HTTP, WP PowerSuite rebuilds the current request using HTTPS and redirects the browser before normal access continues.
This can be useful when you need WordPress-level enforcement for administrative areas without creating a blanket frontend redirect through this module. You can enable protection for wp-admin, the login screen, or both according to how the website is configured.
Force SSL Admin does not issue or install an SSL certificate. HTTPS must already work correctly for the relevant domain before you enable enforcement. The module's role is to ensure selected WordPress administrative requests use the secure connection that your server already provides.
Handle HTTPS Behind Trusted Proxies
Not every WordPress website connects directly to the public internet.
Cloud platforms, reverse proxies, load balancers, and CDNs can terminate HTTPS before forwarding the request to the origin server. In these configurations, the visitor may genuinely be using HTTPS even though the connection arriving at WordPress appears different.
Incorrect HTTPS detection in this environment can create redirect loops because WordPress repeatedly believes the secure visitor is still using HTTP.
Force SSL Admin checks WordPress's normal SSL state while also supporting WP PowerSuite's trusted-proxy HTTPS detection. Developers can additionally customize HTTPS detection through the provided filter when a particular infrastructure requires it.
This makes the module better suited to modern hosting environments than a simple redirect snippet that only checks one server variable.
Proxy configuration still needs to be correct. The module cannot compensate for an incorrectly configured reverse proxy that provides unreliable or untrusted connection information.
Recover With an Emergency Disable Link
An HTTPS enforcement tool needs a recovery mechanism because a broken SSL certificate, DNS change, reverse-proxy mistake, or incorrect server configuration can potentially make wp-admin difficult to access.
Force SSL Admin generates a private emergency disable URL containing a long random secret. Opening that URL disables the module without requiring normal WordPress authentication.
Once successfully used, the secret is immediately rotated so the same URL cannot be reused. Administrators can also generate a new emergency link manually, which invalidates the previous one.
The emergency link should therefore be treated like a password. Anyone who possesses a valid link can disable Force SSL Admin, so it should be stored securely and never published or shared unnecessarily.
This recovery mechanism gives administrators another way back into the site when the very feature intended to enforce secure access becomes difficult to manage because the surrounding SSL environment has changed.
