WordPress 7.1 includes a fix for incorrect HTTP URLs in multisite signup and activation when SSL is enabled. Real networks add reverse proxies, forwarded headers, mapped domains, subdomain or subdirectory sites, network-admin URLs, transactional email rewriting, security plugins, and CDN redirects. An apparently harmless HTTP link can trigger an extra redirect, lose a token, reach the wrong network host, or fail only for one site mapping.
Use this after WordPress 7.1 on multisite networks that allow registrations, create sites, invite users, map domains, terminate TLS at a proxy, or customize signup and activation emails.
Quick answer
Create synthetic new-user, existing-user, new-site, invited-user, expired-key, reused-key, subdomain, subdirectory, and mapped-domain fixtures. Record network home, site home, site URL, admin URL, is_ssl result, trusted forwarded-proto configuration, canonical host, and generated email links. Open each link in a clean browser with redirects captured. Require HTTPS from the first generated URL, one intended host, a preserved activation key, correct cookie scope, and a final page that matches the network action.
Test scenarios to run
Run the same controlled fixture across these branches. Write down the expected result before testing so a surprising response is easy to identify.
| Scenario | Fixture | Expected result |
|---|
| New user | Primary network HTTPS | Secure link activates once |
| Mapped domain | Site-specific host | Correct host and cookie scope |
| Proxy TLS | Forwarded proto trusted | No HTTP link or loop |
| Expired key | Old synthetic token | Safe error, no activation |
Diagnostic table
Use this table to connect the observed behavior to evidence and a verification step.
| Action | Evidence | Verification |
|---|
| Map network URL ownership | Record WordPress version, network type, domain mapping, TLS termination, forwarded headers, home and site URLs, cookie domains, and email plugins. | Every generated signup, invite, and activation URL starts with HTTPS. |
| Create synthetic signup fixtures | Generate user signup, site signup, invitation, activation, expiration, reuse, subdomain, subdirectory, and mapped-domain fixtures with unique synthetic IDs. | Primary, mapped, subdomain, and subdirectory fixtures reach the correct network action. |
| Trace email and redirects | Capture raw email source, rewritten links, redirect chain, Host, scheme, status, Location, cookies, cache headers, page fingerprint, and final database state. | Expired, reused, denied, and wrong-host keys fail safely without state changes. |
| Fix proxy and mapping inputs | Compare direct origin, proxy, CDN hit and miss, IPv4, IPv6, network primary domain, and mapped-domain paths. | Proxy, CDN, cookies, email rewrites, database state, and logs agree. |
What to check first
- Record WordPress version, network type, domain mapping, TLS termination, forwarded headers, home and site URLs, cookie domains, and email plugins.
- Generate user signup, site signup, invitation, activation, expiration, reuse, subdomain, subdirectory, and mapped-domain fixtures with unique synthetic IDs.
- Capture raw email source, rewritten links, redirect chain, Host, scheme, status, Location, cookies, cache headers, page fingerprint, and final database state.
- Compare direct origin, proxy, CDN hit and miss, IPv4, IPv6, network primary domain, and mapped-domain paths.
- Test administrator, logged-out user, existing member, new user, expired key, reused key, and cross-site navigation without exposing real invite tokens.
Field notes
- Write the expected result before changing anything and keep one repeatable synthetic fixture for the full test window.
- Record exact versions and UTC timestamps because caches, retries, scheduled actions, and deployments can change the evidence between checks.
- Test the public path and the stored server-side result, not only an admin preview, isolated command, or API response.
- Review the result again after the relevant cache, queue, cron, webhook, and observation window has completed.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
curl -sS -D - --max-redirs 0 'https://network.example.test/wp-activate.php?key=REDACTED'
# Record every Location header without sharing the live key.
# Compare network, mapped-domain, subdomain, and subdirectory fixtures.
# Activation routes should bypass shared HTML caching.
Why this usually happens
- WordPress sees the proxy-to-origin connection as HTTP because forwarded scheme headers are not trusted correctly.
- An email or security plugin rewrites the activation URL after WordPress generates it.
- Domain mapping changes the host while the token or cookie remains scoped to the network domain.
- A CDN caches an activation response or redirect that must remain user and token specific.
Decision rule
Release only when the first generated link is HTTPS, redirects preserve the intended host and key, activation occurs exactly once, and shared caches never store token-specific output.
Production verification checklist
- Every generated signup, invite, and activation URL starts with HTTPS.
- Primary, mapped, subdomain, and subdirectory fixtures reach the correct network action.
- Expired, reused, denied, and wrong-host keys fail safely without state changes.
- Proxy, CDN, cookies, email rewrites, database state, and logs agree.
Safe fix order
Use a sequence that makes each result easy to prove. Stop when new evidence changes the scope or owner of the problem.
- Map network URL ownership
- Create synthetic signup fixtures
- Trace email and redirects
- Fix proxy and mapping inputs
- Verify state, cookies, and cache
Mistakes to avoid
- Changing production before recording exact versions, UTC timestamps, a stable fixture, the expected result, and a tested rollback point.
- Treating one successful screen as proof while logs, stored records, background jobs, caches, emails, APIs, and downstream systems remain unchecked.
- Testing only as an administrator instead of using the role, device, locale, cache state, request path, and failure branch that users actually reach.
- Leaving debug output, temporary exclusions, helper accounts, duplicate hooks, broad permissions, or relaxed firewall rules active after verification.
Questions teams ask during testing
Can I test this directly in production?
Start with read-only evidence. Use staging for code, package, security, checkout, form, privacy, or cache changes. If a production canary is necessary, make it identifiable, reversible, monitored, and incapable of exposing personal data or charging a customer.
How do I avoid a false positive?
Repeat the same fixture with the same versions, URL, role, locale, cache state, and downstream integration. Compare the public result, stored result, and logs instead of relying on one browser view.
What evidence should I retain?
Keep UTC time, exact versions, request or record ID, expected result, actual result, relevant log lines, change made, rollback point, owner, and final verification. Redact credentials, tokens, and personal data.
When is the work complete?
Close it when the primary path passes, failure branches are understood, stored and downstream records reconcile, temporary changes are removed, monitoring is active, and the owner has the evidence packet.
What to tell the client or owner
Give the owner a concise packet with the affected workflow, exact versions, UTC test time, synthetic fixture ID, expected result, actual result, key logs, change made, rollback point, final result, unresolved risks, owner, and next review date. Remove credentials and personal data before sharing it.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, security, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, have HandL WP test a WordPress multisite upgrade.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references