How FORCE_SSL_ADMIN protects WordPress login and administration traffic when HTTPS is configured correctly.
Why this check matters
Admin sessions contain powerful credentials and actions. Forcing HTTPS for administration helps prevent them from crossing an unencrypted connection.
How to review it
- Confirm the certificate and canonical hostname work first.
- Enable administration HTTPS through the documented configuration.
- Test login, media uploads and the editor after the change.
- Check reverse-proxy settings if WordPress reports the wrong scheme.
Keep the change safe
If a proxy terminates TLS, configure trusted proxy headers correctly before forcing SSL or you may create a redirect loop.
How WPVitals uses this signal
WPVitals checks this setting locally and reports the result in the WordPress dashboard. The check is a maintenance signal, so review the site context before changing a setting and test the visitor experience afterwards.