title: Wordpress and AWS CloudFront (Sorry, you are not allowed to access this page.)
body: <p>I have been migrating a website from classic hosting to AWS (EC2 + CloudFront) and I would like to use Flexible-SSL which means that client (browser) use SSL(HTTPS) to comunicate with CloudFront, and CloudFront calls to the origin using HTTP unsecurely. Then is needed to set 'home' and 'siteurl' with '<a href="https://www.myowndomain.com" rel="nofollow noreferrer">https://www.myowndomain.com</a>' in order to generate all URLs with https and avoid a redirections loop.</p>
  
  <p>The first problem was the mixed content. I solved it using this code in <em>wp-config.php</em> (To help someone who needs it):</p>
  
  <pre><code>if (isset($_SERVER['HTTP_CLOUDFRONT_FORWARDED_PROTO']) &amp;&amp; $_SERVER['HTTP_CLOUDFRONT_FORWARDED_PROTO'] == 'https'){
      $_SERVER['HTTPS']='on';
  }
  </code></pre>
  
  <p>The second problem is still unresolved and is taking me too many days...</p>
  
  <p>When I go to wp-login and I do the login... the page respond me with:</p>
  
  <blockquote>
    <p>403  - Sorry you are not allowed to access this page</p>
  </blockquote>
  
  <p>If I go back to the home page, the website with menu bar is shown, but when I click on one option, It responds me again with the same message (and HTTP Status).</p>
  
  <p>Things I have done before coming here:</p>
  
  <ul>
  <li>Disable all plugins, doing rename to all the plugins folders.</li>
  <li>Disable plugins using wp-cli.</li>
  <li>Search and replace all "http://" strings to "https://" using wp-cli in database.</li>
  <li>Check that <em>home</em> and <em>siteurl</em> wordpress variables are '<a href="https://www.myowndomain.com" rel="nofollow noreferrer">https://www.myowndomain.com</a>'.</li>
  <li>Change the theme to default.</li>
  <li>Reload/remove the .htaccess</li>
  <li>Enable wordpress logs and nothing logged.</li>
  <li>Check all permissions, apparently all ok.</li>
  <li>Check database tables prefix configuration.</li>
  <li>Check all headers using the forensic module in Apache server-side. Some CloudFront headers added to the request but aparently nothing which could influence the issue.</li>
  <li>Check that all the cookies needed by wordpress were sent by the browser and received by the Apache server through CloudFront: <em>wordpress_logged_in_ and wordpress_sec_</em>.</li>
  <li>Debug a little bit adding some check points to the code... but I'm not wordpress developer and it costs me a lot to understand why this is happening. The 403 page is being triggered from <em>/var/www/html/wp-admin/includes/plugin.php</em> in function <em>get_admin_page_parent()</em>.</li>
  <li>Clean browser cache again and again.</li>
  <li>Obviously search again and again.</li>
  </ul>
  
  <p>What a mess! The last measure I took was to do a fresh-clean wordpress installation. The result... the same.</p>
  
  <p>I'm stuck now. Any suggestion is welcome.</p>
  
  <p>Thanks in advance.</p>