NGINX Heroku WordPress

NGINX, Heroku, and WordPress combined. This website is powered by WordPress on Heroku. Details on configuration are here.

My next #DevOps task is to add NGINX in front of the WordPress application. In the future, this could be used as a load balancer. Until then, NGINX will reverse proxy the requests to the Heroku application instance.

To start, I spun up a virtual machine running Ubuntu on Amazon’s EC2. Check out how to install and configure NGINX here. Make sure to open your firewall to HTTP & HTTPS traffic!

I encountered two major issues:

  1. The request passed by NGINX through the reverse proxy was not being understood by Heroku’s application stack.
  2. Once the application stack properly handled the request, WordPress’s response triggered a redirect loop.

Reverse Proxy

Heroku’s stack uses the host of the request to route to the appropriate application instance. The originating Host value is (in my example) ‘’. Heroku shouldn’t respond to this. Turn off the app’s Custom Domain feature if it does. Update the reverse proxy to set a new Host header that Heroku will respond to.

server {

    location / {
        proxy_set_header Host;

    # configure SSL here

Redirect Loop

Setting the Host request header got Heroku’s attention, now WordPress responds to that request with a redirect loop. I encountered this problem while trying to configure an HTTPS-only WordPress installation. The way out of the redirect loop was to update two more request headers and then to use those headers in the WordPress configuration. Here’s the new section of wp-config.php

if ( $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' )
        $_SERVER['HTTPS']       = 'on';
        $_SERVER['SERVER_PORT'] = '443';
        define('FORCE_SSL_ADMIN', true);

if ( isset($_SERVER['HTTP_X_FORWARDED_HOST']) ) {

That gets WordPress to not redirect to https on these proxied requests, but only if the request headers of X-Forwarded-Proto and X-Forwarded-Host are specified. The NGINX configuration now is:

server {

    location / {
        proxy_set_header Host;
        proxy_set_header X-Forwarded-Host $host;    
        proxy_set_header X-Forwarded-Proto $scheme;

    # configure SSL here

That’s how I got NGINX, Heroku, and WordPress to play well together. Next task is to use an upstream for the proxy_pass directives. What’s your infrastructure layout and what did you learn along the way? Tell me about it in the comments!


WordPress 5 on Heroku

I started off using mhoofman/wordpress-heroku. One gotcha from there is that the PostgreSQL plugin does not work.  Here’s what worked for me on my Ubuntu 18.10 desktop.


wget, git, and heroku-cli

$ sudo apt install git wget git
$ sudo snap install --classic heroku
Get WordPress

Download from, extract, move wp-config-sample.php to wp-config.php.

$ wget
$ tar xzvf latest.tar.gz
$ cd wordpress
$ mv wp-config-sample.php wp-config.php

I then made the following edits to wp-config.php  This allows all parameters to be set via ‘heroku config:set’.  The first block is used to configure the WP Offload Media Lite plugin.

define( 'AS3CF_SETTINGS', serialize( array(
    'provider' => 'aws',
    'access-key-id' => getenv('AWS_ACCESS_KEY_ID'),
    'secret-access-key' => getenv('AWS_SECRET_ACCESS_KEY'),
) ) );

Now get and parse the MySQL connection.

$url = parse_url(getenv('CLEARDB_DATABASE_URL'));

define('DB_NAME', trim($url['path'], '/'));
define('DB_USER', $url['user']);
define('DB_PASSWORD', $url['pass']);
define('DB_HOST', $url['host']);

Finally, define authentication keys and salts.

define('AUTH_KEY',         getenv('AUTH_KEY'));
define('SECURE_AUTH_KEY',  getenv('SECURE_AUTH_KEY'));
define('LOGGED_IN_KEY',    getenv('LOGGED_IN_KEY'));
define('NONCE_KEY',        getenv('NONCE_KEY'));
define('AUTH_SALT',        getenv('AUTH_SALT'));
define('LOGGED_IN_SALT',   getenv('LOGGED_IN_SALT'));
define('NONCE_SALT',       getenv('NONCE_SALT'));
Download and install plugins and themes.

I added the following plugins. Unpack each into the ‘/wp-content/plugins’ directory.

Do the same with desired theme, unpacking to ‘/wp-content/themes’.

Initialize git repository and create Heroku app

The base code, plugins, and themes are in place. wp-config.php created and modified.  Now initialize a git repository and create an App on

$ git init .
$ heroku create
Add MySQL and Sendgrid
$ heroku addons:create cleardb
$ heroku addons:create sendgrid
Now set those configuration variables

You’ll need your AWS Access Keys.

$ heroku config:set AWS_ACCESS_KEY_ID
$ heroku config:set AWS_SECRET_ACCESS_KEY

Authentication keys and salts must also be configured.  Do it one-by-one, or script it.

$ heroku config:set AUTH_KEY:a-strong-password
$ heroku config:set SECURE_AUTH_KEY:another-strong-password

Continue for all the keys and salts.

That’s it! Deploy and then configure your site and the plugins from WordPress itself.
$ git checkout -b production
$ git push heroku production:master

Point your web browser to Heroku’s App URL.  You should then get WordPress’s famous five-minute install. You can see my resulting code at terryg/wordpress-heroku.