Wordpress admin not loading properly

Website, Application, Performance Getting Started
1

Hi there, Each time I try and enable Clourdflare for a wordpress site and change the name servers via my webhost provider, it creates a few load issues for WP admin and the plugin admin sections as well as not loading images on the front end.

In other words it doesnt load the style, images and java. Below is a screengrab of the wp rocket plugin’s settings page. This issue is across all aspects of wp admin. The settings pages don’t usually display in basic html / text and links only.

I’ve set up the rules to not cache wp-admin along with other tips for standard cloudflare settings, and havent come across any sites or forum posts that have this issue… so not sure what to do.

Please help point me in the right direction.

In the mean time, i’ve reverted the host names back to the webhost’s original names, because I need the site to be live and working without issue.

WP admin not loading properly once Clourdflare is enabled
WP admin not loading properly once Clourdflare is enabled1772×758 78.1 KB

2

With the site not on Cloudflare, I can’t check for sure, but it sure looks like Mixed Content:

3

Hi @sdayman, thanks for the prompt reply and tips.

I’ve renamed the servers so now they’re back to Cloudflare and I’ve also followed your advice. Nonetheless, it looks like I’m having similar issues as before.

I activated the SSL Insecure Content Fixer app and have enabled various settings to see if that fixes it. Unfortunately it doesn’t… I cleared the site and Cloudflare cache after each change.

When using Chrome, I don’t have a small shield / red x displayed.

In Cloudflare, the SSL setting is on ‘Full’ and the Automatic HTTPs Rewrites is switched ‘on’.

I’ve looked into updating the Content Security Policy Header, but haven’t added that, because I haven’t come across the right code to add and where to add it. Some resources say the .htacess file some say just add “Content-Security-Policy: upgrade-insecure-requests” to the header, which doesn’t work…

I figure it has something to do with my settings or something is missing for Cloudflare to work properly, because it doesn’t happen when the site isn’t using Cloudflare.

Any further tips to fix this would be greatly appreciated.

4

As it’s wp-admin, I can’t check, even if you told me the domain name. But what I suggest is that you open your browser’s Dev Tools (F12 in Chrome) and look at Console for error messages.

5

I’m getting a lot of these errors:

Failed to load resource: the server responded with a status of 403 ()

Most are CSS files and some JS not loading from plugins.

6

Which SSL mode are you using? Hopefully it’s Full (Strict)

Also, maybe your server logs can show these 403 errors. And…if you copy/paste the URL of one of those CSS or JS files into your browser, does it load?

7

I was using ‘Full’ as my setting for SSL, so I changed it to ‘Full - strict’.

Also, tried loading one of the CSS files in a browser and I got this message:

Error 1020 / access denied - This website is using a security service to protect itself from online attacks.

I’m guessing I have to look at my security plugin’s settings, unless that error refers to other security. not sure…?

8

Did that 1020 error look like a Cloudflare error screen?

9

I think so… sorry should’ve included a screen grab in the last message. attached is an image of the error message.

Error 1020 Annotation 2020-04-14 125015
Error 1020 Annotation 2020-04-14 1250151155×436 36.3 KB

10

Check the Cloudflare Dashboard’s Firewall section for the Firewall Events Log to see why that URL was blocked.

11

hmmm… could be the firewall rule I set up to Protect insecure plugins. It’s been hit 1.52K times in the last 24 hours. a lot of those are from Philippines.

I’ve temporarily switched that rule off. Will see if that resolves the issue, once I’ve purged caches / refresh, etc.

12

…so that’s definitely fixed the loading issue, which is awesome! Thanks for your help…
On a slightly related note, by stopping that firewall rule, would it cause any security issues?

Below is a screengrab, what’s marked in red is the url.

Firewall rule
Firewall rule1126×480 38.7 KB

13
  1. I highly recommend Wordfence to protect against attacks like this. Even the free version is excellent.
  2. You might try changing that Referer to say “contains” with your domain name.
14

Awesome work! I’ll check out those options.

You’ve been an amazing help.

1 Like
16

This topic was automatically closed after 14 days. New replies are no longer allowed.