OS X Server 5 for OS X 10.10. and 10.11, while a significant improvement to Lion Server for OS X 10.7, still behaves oddly when mixing SSL and non-SSL requests. Whereas before it wanted every request redirected to the SSL pipe, now it will let you do either. It won’t, however, let you do both.

WordPress will try to do both. Why? I dunno. It should work, and did on plain Apache 2, but OS X Server 5 puts up a proxy to the WAN and serves from a different port. This is not presented upfront to the Server.app user, but is most likely in the docs. RTFM much? Ha-ha! No.

The affect this had on my WordPress install is instead of logging in being presented with a page that merely stated,

You don’t have permission to view this page.

Or some such equally helpful information. A little web searching turned up the answer. To overcome this the following can be added to wp-includes/http.php

/* Adding this BS for OS X Server 5 being a dick... */
if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
$_SERVER['HTTPS']='on';
}

I saw a post on wordpress.net that said to put this into config.php, but that did not work for me. Neither did the mod_rewrite mumbo-jumbo in that thread and apparently it didn’t for the OP, either.

I admit being ignorant to what HTTP_X_FORWARDED_PROTO is, but it appears to be a HTTP header from an Apache mod Apple is running. Unique to them or something well known? I dunno. I don’t pretend to try to keep up with this stuff any longer. That’s why I went to WordPress; So I wouldn’t have to.