# Enable Secure Admin for Wordpress

> Secure your Wordpress administration area using a self-signed certificate and Nginx webserver.

- Author: Curtis Miller
- Published: 2009-07-19
- Categories: ops, how-to
- Canonical URL: https://millarian.com/posts/enable-secure-admin-for-wordpress/

**Disclaimer** : I'm not a security expert :)

Since I work from unsecured wireless at coffee shops, etc. I wanted to have a way to access my Wordpress admin area without having to use something like [Chris Chandler](https://squanderingti.me)'s [secure proxy using Amazon EC2](http://velocitylabs.io/blog/2009/04/23/disposable-proxy-for-secure-coffee-shop-browsing/). Here's are the steps I followed.

1. Create a [self-signed certificate](http://sial.org/howto/openssl/self-signed/) on your webserver
2. Tell Nginx how to handle the secure requests (dead link: http://articles.slicehost.com/2007/12/19/ubuntu-gutsy-nginx-ssl-and-vhosts) by modifying your nginx.conf or virtual host files. Be sure to turn SSL on and point Nginx to the key and certificate you created in step 1
3. Modify your wp-config.php file to turn on [secure administration in Wordpress](http://codex.wordpress.org/Administration_Over_SSL)
4. Restart Nginx
5. Test it out by navigating to your wp-admin page; it should redirect you to the secure URL and ask you to make an exception for the self-signed certificate

I'm pretty sure that's all I did, but my memory has proven to be faulty in the past. Is there anything I missed?

**Do you have any other suggestions for securing the Wordpress admin area?**