Hello there,<\/p>\n
I use single site WP FEMP setup behind nginx proxy, which terminates https requests (also 301 redirect all requests to https) and passing them to another nginx servers (in freebsd jails). In jails I have only local IPs (10.0.0.2, etc) and connections from external IP redirected with pf firewall to proxy (which distribute them to different services, including the WP installation). All usually works smoothly without any problem. Except the REST API.<\/p>\n
I noticed quite long time ago that Site Health Status reports two problems, both related to loopback requests, though quite non-specific:<\/p>\n
1. The REST API encountered an error: The REST API request failed due to an error.
\n Error: Connection refused (http_request_failed)
\n2. Your site could not complete a loopback request: The loopback request to your site failed, this means features relying on them are not currently working as expected.
\n Error: Connection refused (http_request_failed)<\/ol>\n
Since I do not use scheduling for posts (at least at the moment) it didn’t bother me much. Alas, the problem comes from the further astonishing WP development. After updates of WP and plugins (I do the chores once in couple of months) some plugins refused to work, namely “Redirection”, “Yoast SEO” to index content, etc.<\/p>\n
My fingers grew really tired while searching info to mitigate the issue. A lot of try and error, but eventually I managed to pin down the problem to some extent. If I specify the domain of the WP website in hosts file, like I can mitigate such by disabling all advanced security setup in naxsi, but that against my vision. Also I could live without scheduling, at least for a while till the further progressive development render this a real problem.<\/p>\n If I specify tor the localhosts the IP of the WP installation, which probably is intended to work this way, the REST API still doesn’t work, though I easily access website from curl from inside the jail.<\/p>\n The wp-cli works except the cron command. In The nginx configs are rather long, but comply with codex and I would post them if needed.<\/p>\n My wild guess is that REST API make request to WP with https, but I don’t know how to proof or exclude this, since I have almost no knowledge of PHP and where to look for.<\/p>\n I have a strong feeling, that I miss something very obvious, which prevent the REST API to work as expected. But I have exhausted all ideas and feel like I am about to jeopardies security eventually.<\/p>\n Could you please point me to the right direction? I am banging my head against the wall…<\/p>\n","protected":false},"template":"","class_list":["post-13718616","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/13718616","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/13718616\/revisions"}],"predecessor-version":[{"id":13718619,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/13718616\/revisions\/13718619"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=13718616"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}10.0.0.3 example.com<\/code>, where the IP is for nginx proxy, Site Health Status stops to complain. But other issues appear:<\/p>\n\n1. in Site Health Status the warning: A scheduled event has failed. The scheduled event, action_scheduler_run_queue, failed to run
\n2. in Site Health Status the warning: The REST API did not behave correctly. The REST API did not process the context<\/code> query parameter correctly
\n3. XSS cookies, I suppose due to the difference of the hosts (proxy and WP)<\/ol>\nwp-config.php<\/code> I have besides other staff the following:<\/p>\n\nif (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false && $_SERVER['REMOTE_ADDR'] != '10.0.0.3')\n\t$_SERVER['HTTPS']='on';\n\/\/ Code for showing correct client IP address\nif ( isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) { \n $mte_xffaddrs = explode( ',', $_SERVER['HTTP_X_FORWARDED_FOR'] ); \n $_SERVER['REMOTE_ADDR'] = $mte_xffaddrs[0]; \n}\ndefine('FORCE_SSL_ADMIN', true);\n<\/code><\/pre>\n