1 Introduction

When we use WordPress to build our own personal blog, we often encounter the problem that we need to use multiple ways to access WordPress. For example, in the intranet, I want to use the intranet address 192.168.xx to access it, and in the extranet, I want to use the domain name bbs1.example.com to access it, or I also want to use bbs2.example.com to access it. This requirement is actually very normal and common, but it cannot be achieved in the default WordPress, because by default WordPress will bind to the access address used during initialization (it may be an IP address or a domain name).

In fact, if WordPress does not do the SSL decryption itself (the usual practice now is to perform SSL decryption on the reverse proxy if there is a reverse proxy), then WordPress locking an access address is not very meaningful from a security perspective, because the access domain name of the request that can reach WordPress through the reverse proxy must be correct.

In order to enable WordPress to support multi-domain access, there are generally three ways to implement it.

Method 1: Modify wp-config.php

The domain name bound when initializing WordPress is stored in the database. The specific location is in the table wp_options in the library corresponding to WordPress:

The method for modifying wp-config.php that we'll discuss in this section utilizes the principle in WordPress that constants have higher priority than variables defined in the database for the same setting. WordPress has two constants, WP_HOME and WP_SITEURL, which correspond to the home and siteurl in the database, respectively. Therefore, setting these two constants in wp-config.php will take precedence over settings in the database. There are two approaches to modifying this method.

1. Fully open without any restrictions

In the wp-config.php filedefine('WP_DEBUG', false);Add the following code afterwards:

$scheme = 'http'; if ( isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) { $scheme = 'https'; } define('WP_SITEURL', $scheme . '://' . $_SERVER['HTTP_HOST']); define('WP_HOME', $scheme . '://' . $_SERVER['HTTP_HOST']);

This code dynamically sets the WordPress site address based on the actual access protocol (HTTP/HTTPS) passed by the reverse proxy and the current host, ensuring that the correct URL is generated in either Cloudflare Tunnel or a regular reverse proxy environment.

Of course, this method relies on the premise that all requests to WordPress are legitimate. Therefore, it can only be used in conjunction with a reverse proxy or by filtering out illegal domain requests to WordPress through security measures.

2. Directly limit the domain name that can access WordPress

In the wp-config.php filedefine('WP_DEBUG', false);Add the following code afterwards:

$host = $_SERVER['HTTP_HOST'];

$allowed_hosts = [
    'bbs1.example.com',
    'bbs2.example.com',
    'bbs3.example.com',
];

if (!in_array($host, $allowed_hosts)) {
    $host = 'bbs1.example.com';
}

$scheme = (
    isset($_SERVER['HTTP_X_FORWARDED_PROTO']) &&
    $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https'
) ? 'https' : 'http';

define('WP_SITEURL', $scheme . '://' . $host);
define('WP_HOME', $scheme . '://' . $host);

这段代码实现的功能，除了可以根据真实访问协议（HTTP/HTTPS）和当前 Host 动态设置 WordPress 站点地址以外，同时还通过 Host 白名单限制可接受的访问入口(比如上面代码中的bbs1.example.com,bbs2.example.com和bbs3.example.com,)，防止非法 Host Header 导致WordPress 生成错误的 URL(如果是非法Host Header，则强制访问bbs1.example.com)，适用于反向代理、多入口及直接部署等场景。

However, it's important to note that the two methods above are ineffective for static resources in WordPress, such as attachments and images uploaded to WordPress. To modify the address of such static resources, you also need to insert the following code:

define( 'WP_CONTENT_URL', '//' . $_SERVER['HTTP_HOST'] . '/wp-content');

Note: Modifying wp-config.php will cause the siteurl and home fields in the backend settings interface to become gray and unable to be modified:

Method 2: Modify the function.php file of the current theme.

Method 2 is actually the same as Method 1, both of which use the method of setting the two constants WP_HOME and WP_SITEURL, but Method 1 is set in wp-config.php, while Method 2 is set in function.php of the current theme. The settings are the same, so I will not repeat them here.

4. Method 3: Plugin

There should be many plug-ins to achieve multi-domain access. I used Multiple Domain before:

This plugin is actually very good, but it hasn’t been updated for a long time, which made me, who has obsessive-compulsive disorder, very unhappy, so I later switched to modifying wp-config.php.

Note: Using the plugin in this way will not cause the siteurl and home options in the background settings interface to become gray.

5 Conclusion

There is no absolute superiority or inferiority among different methods; the key is to consider your own actual needs.

If you're simply migrating your entire website to a new domain and don't need to retain access to the old domain, then directly modifying the site address in the database is usually the simplest and most straightforward solution. Once configured, WordPress will run normally under the new domain, requiring virtually no further maintenance.

If you need to support multiple access points simultaneously, such as multiple domains, internal IPs, reverse proxies, Cloudflare Tunnel, Tailscale, etc., then you can use plugins, or in... wp-config.php,functions.php Dynamic settings WP_HOME,WP_SITEURL It will be more flexible. This method can automatically generate the corresponding site address based on the access point, making it more suitable for some special deployment environments.

It should be noted thatwp-config.php and functions.php Settings configured in the database take precedence over those in the main database, so they can be used not only as routine configuration solutions but also as emergency measures. For example, when the site address in the database is misconfigured, or when a plugin causes the backend to be inaccessible, temporary overriding can be done in the code. WP_HOME and WP_SITEURLThis often allows for quick restoration of website access, enabling users to access the backend and continue addressing other issues.

It needs to be emphasized again:

If you are accessing multiple domains by setting the constants WP_HOME and WP_SITEURL, it is recommended not to directly trust them. $_SERVER['HTTP_HOST']Instead, restrictions should be implemented in conjunction with a host whitelist, and based on the actual access protocol passed by the reverse proxy (such as...). X-Forwarded-ProtoDynamically determine HTTP/HTTPS.

This approach balances the flexibility of multiple access points with the prevention of WordPress generating incorrect site URLs due to unauthorized Host Headers, making it more secure and reliable in deployment scenarios such as VPS direct connection, reverse proxy, and Cloudflare Tunnel.