Enable Secure Admin for WordPress

Disclaimer: I’m not a security expert :)

Since I work from unsecured wireless at coffee shops, etc. I wanted to have a way to access my WordPress admin area without having to use something like Chris Chandler‘s secure proxy using Amazon EC2. Here’s are the steps I followed.

  1. Create a self-signed certificate on your webserver
  2. Tell Nginx how to handle the secure requests by modifying your nginx.conf or virtual host files. Be sure to turn SSL on and point Nginx to the key and certificate you created in step 1
  3. Modify your wp-config.php file to turn on secure administration in WordPress
  4. Restart Nginx
  5. Test it out by navigating to your wp-admin page; it should redirect you to the secure URL and ask you to make an exception for the self-signed certificate

I’m pretty sure that’s all I did, but my memory has proven to be faulty in the past. Is there anything I missed?

Do you have any other suggestions for securing the WordPress admin area?

Posted July 19th, 2009 at 5:23 pm in Programming | Permalink


  1. amanda:

    if i might suggest, its easier to just use Passpack…. that way you don't need a separate solution for each and every site. I mean, ideally, you want to log into all sites securely from unsecured wifi, no?

  2. Curtis Miller:

    Yes, if you're using an untrusted network, it's a good idea to use secure login. For example, I have Gmail "Always use https" setting enabled and I use https://twitter.com/login to login to Twitter.

    I haven't heard of Passpack, but it looks interesting. The language on their site talks about securely storing and retrieving your passwords, but I didn't see anything about what happens after you unpack your password client side and send it through insecure means. If they do something, then it is probably pretty similar to the secure proxy approach that Chris describes. Not sure if I can use Passpack with my iPhone either…

  3. Ben Atkin:

    I thought about using my external OpenID account, with SSL, for login, but I realized that if I connected over plain http, my cookie could still get sidejacked, and someone could gain temporary access to my WordPress account. Still, it would be better than having my password sent in plaintext, as is the case now. Unfortunately, I could not get login through the OpenID plugin to work (it only claims support through WordPress 2.7, but still installed on WordPress 2.8)


    I'm going to try to get HTTPS with a self-signed certificate up and running soon, as I think it's the best option.

    After reading your post and thinking about security, I went into OS X network preferences and deleted all but a couple of my remembered networks, and unchecked the option to remember all networks I join. I don't want to pop open my laptop at Xtreme Bean and have someone snag my password from an ajax app before I even realize I've joined an unsecured network.

    I've been thinking about security a lot lately. I've been reading Cryptonomicon, and on Saturday I learned how to use OAuth for twitter authentication, and in the process spent a few hours reading about how OAuth works. It's fascinating. The article below provides a pretty good and relatively easy to digest description of the protocol.


Leave a response: