Put HAProxy in front of two or more equivalent WordPress web servers, terminate or pass through TLS at a controlled boundary, and send requests to a backend that uses application-level health checks. Start with round-robin distribution; add cookie persistence only when a plugin or session workflow genuinely requires it.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
HAProxy balances HTTP traffic, but it does not synchronize WordPress. The origins still need one authoritative database, consistent code and settings, shared or reliably replicated uploads, coordinated cache and cron behavior, and a plan for sessions. The following design and validation steps show how to make those pieces work together without redirect loops or unsafe failover.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What HAProxy does for a WordPress cluster
HAProxy is the public reverse proxy. It accepts client connections on the public address, applies TLS and HTTP policy, chooses a healthy origin, and forwards the request. The HAProxy project describes it as “a free, very fast and reliable reverse-proxy offering high availability, load balancing, and proxying for TCP and HTTP-based applications.”
WordPress remains responsible for generating pages, handling logins, writing content, running plugins, and serving media. HAProxy only knows what its checks and responses tell it; it cannot merge databases, copy uploads, invalidate caches, or make two PHP installations behave identically.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Reference architecture and prerequisites
A typical layout is:
Client
|
v
HAProxy public IP
|
+-- frontend http-in (port 80 redirect)
+-- frontend https-in (port 443 TLS)
|
v
backend wordpress_web
| |
v v
WordPress 1 WordPress 2
/
/
authoritative database
shared or replicated media/cache servicesUse one public hostname and certificate at HAProxy when it terminates TLS. The origins may receive HTTP over a private network, or HTTPS when policy requires encryption all the way to the web servers. Keep the HAProxy management interface and origin addresses off the public internet; permit origin traffic only from the proxy network and restrict administrative access separately.
Before you configure HAProxy
- Choose the canonical hostname, such as
example.com, and decide whether thewwwname redirects or serves the same site. - Install the same WordPress core, plugins, themes, PHP version and relevant PHP settings on every origin.
- Decide where the authoritative database lives and verify that every origin can reach it.
- Provide shared or reliably replicated
wp-content/uploads; local disks on separate origins are not equivalent storage. - Identify whether any plugin uses PHP sessions, local files, node-local locks or node-local object cache.
- Create a lightweight health endpoint, for example
/healthz, that can be tested without loading a slow, uncached home page. - Obtain the public certificate and private key in the format required by the installed HAProxy version, and protect the key with filesystem permissions.
Build the HAProxy configuration
The following is a starting pattern, not a tested drop-in. Adapt certificate paths, syntax, timeouts, access controls and origin addresses to the HAProxy version and network you operate.
global
log /dev/log local0
maxconn 4096
defaults
mode http
log global
option httplog
timeout connect 5s
timeout client 30s
timeout server 30s
timeout http-request 10s
frontend http-in
bind :80
http-request redirect scheme https code 301 unless { ssl_fc }
frontend https-in
bind :443 ssl crt /etc/haproxy/certs/example.pem
http-request set-header X-Forwarded-Proto https
http-request set-header X-Forwarded-Host %[req.hdr(Host)]
option forwardfor
default_backend wordpress_web
backend wordpress_web
balance roundrobin
option httpchk
http-check send meth HEAD uri /healthz ver HTTP/1.1 hdr Host example.com
http-check expect status 200
server wp1 10.0.0.11:80 check
server wp2 10.0.0.12:80 checkWhat each important directive accomplishes
| Directive or setting | Purpose | Operational implication |
|---|---|---|
mode http |
Lets HAProxy inspect and route HTTP requests. | Use HTTP rules and HTTP health checks rather than treating the connection as an opaque TCP stream. |
timeout connect |
Limits how long a connection attempt to an origin may wait. | Set it high enough for normal network conditions, but not so high that a dead origin consumes resources. |
timeout client and timeout server |
Bound idle client and origin sessions. | Long uploads or slow administrative requests may require values appropriate to your workload. |
http-request redirect |
Redirects clear-text requests to the public HTTPS URL. | Because this frontend is port 80, clients should receive one redirect and then use HTTPS. |
set-header X-Forwarded-Proto |
Tells WordPress that the original client scheme was HTTPS. | Overwrite the header at the trusted proxy; do not pass an arbitrary client value through. |
set-header X-Forwarded-Host |
Preserves the public Host value for applications that need it. | It prevents internal origin names from leaking into canonical, REST or media URLs. |
option forwardfor |
Adds the client address in the conventional forwarded-for header. | Configure origin logging and any application IP logic to trust only the proxy network. |
balance roundrobin |
Distributes requests sequentially across available origins. | It is the simplest default when origins are equivalent and state is shared. |
option httpchk and the following check lines |
Sends an HTTP request and accepts only the expected status. | An origin can leave rotation when the application path fails, not merely when its TCP port closes. |
Design a health check that reflects WordPress readiness
HAProxy active checks send requests at intervals. After enough failures, a server is removed from the load-balancing rotation; after enough successful checks, it is eligible to return. The check therefore needs to answer “can this origin serve the required WordPress path?” rather than only “is something listening on port 80?”
Use a small, deterministic endpoint
/healthz should return HTTP 200 only when the web server and the PHP path required by your deployment are usable. Keep it fast and free of external calls. A check that renders the home page, waits on a third-party service or performs an expensive database operation can create load precisely when the site is degraded.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
If you cannot provide /healthz, choose another lightweight endpoint that reliably exercises the necessary web and PHP layers. HAProxy supports custom HTTP methods, URIs, headers and expected status codes, so the check can include the public Host header and use HEAD when the endpoint supports it. Test the endpoint directly on each origin and through HAProxy before relying on it for failover.
Do not confuse a healthy check with a healthy site
A 200 response proves only what that endpoint covers. It does not prove that uploads are writable, the database accepts writes, a shared object cache is coherent, or every plugin is compatible. Keep those conditions in deployment and failure tests; add them to the endpoint only if the resulting check remains fast, deterministic and safe under outage conditions.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Prevent HTTPS redirect loops and wrong WordPress URLs
When HAProxy terminates TLS, the connection from HAProxy to an origin may be plain HTTP. Without the original scheme, WordPress can believe the request is insecure and redirect an already-secure visitor back to HTTPS indefinitely. WordPress’s official HTTPS guidance identifies this reverse-proxy situation as a cause of infinite redirect loops.
Tell WordPress which scheme the client used
In wp-config.php, before WordPress finishes loading, use a trusted forwarded header and set the HTTPS server variable:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
&& strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
$_SERVER['HTTPS'] = 'on';
}
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );WP_HOME and WP_SITEURL include the scheme and have no trailing slash. They override the corresponding database values, which is useful when the public URL must remain fixed while origins use private addresses.
Trust only HAProxy’s headers
A visitor can send an arbitrary X-Forwarded-Proto or X-Forwarded-Host header. HAProxy must overwrite or sanitize those values, and origins must accept traffic only from the proxy network. Otherwise a client could influence URL generation, scheme detection, logs or security decisions. Apply the same trust boundary to forwarded client IP information.
Recommended Free Tools
Check the Host header path
If WordPress generates links containing an internal hostname, inspect what HAProxy forwards as Host. A reverse proxy can overwrite the value unless it is explicitly preserved. Ensure the application sees the public hostname, or configure the server name and forwarded-host handling so canonical links, media URLs, REST requests and the administrator URL all use the public address.
Make every origin the same application
Round-robin works only when a request can move from one origin to another without changing the site’s behavior. Treat the following as a consistency checklist rather than optional enhancements.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
| Component | Required design | Typical failure when omitted |
|---|---|---|
| Database | Point every origin at one authoritative database or a tested topology with clear write and failover rules. | Content, settings and user sessions appear different, or writes reach the wrong node. |
wp-content/uploads |
Use shared storage or reliable replication visible at the same path on every origin. | An image uploaded on one node returns 404 when the next request lands on another. |
| Object cache | Use a shared cache when plugins require cross-node coherence, and define purge behavior. | One origin serves stale options, menus or page fragments after a write. |
| PHP sessions | Prefer stateless plugins; otherwise store sessions centrally or use persistence deliberately. | Checkout, membership or administrative workflows lose state after a node switch. |
| Login cookies | Keep WordPress salts, URL settings and authentication-related configuration identical. | Users are logged out or receive inconsistent authentication behavior. |
| WP-Cron | Use one controlled cron executor when multiple origins would run the same scheduled jobs. | Duplicate emails, imports, cleanups or other scheduled work execute concurrently. |
| Code and PHP settings | Deploy the same core, plugins, themes, PHP extensions, limits and web-server rules. | Only some requests fail, depending on which origin receives them. |
| Page caches | Purge or coordinate caches after writes and deployments. | Visitors see old pages even though the database contains the new content. |
Choose round-robin or sticky sessions deliberately
Round-robin: the normal starting point
Use round-robin when origins are equivalent and state is shared. It spreads requests without binding a visitor to a particular server, so an origin can be removed and the next request can use a healthy peer. This is also the easiest design to reason about during maintenance.
Cookie persistence: only for a real application requirement
Some plugins or legacy session designs require a visitor to return to the same origin. HAProxy supports an explicitly named persistence cookie and cookie insertion or rewrite modes. A representative pattern is:
Free tools Windows power users keep installed
One-click scans. No signup required.
backend wordpress_web
balance roundrobin
cookie WPSERVER insert indirect nocache
option httpchk
http-check send meth HEAD uri /healthz ver HTTP/1.1 hdr Host example.com
http-check expect status 200
server wp1 10.0.0.11:80 check cookie wp1
server wp2 10.0.0.12:80 check cookie wp2Use one persistence cookie for the backend and verify that the application tolerates a node disappearing. Existing cookies cannot make an unavailable server healthy; HAProxy must be able to select another server, and the application still needs shared database, media and cache state. Persistence can also concentrate traffic on one origin and make maintenance less transparent, so do not enable it merely because it feels safer.
TLS termination choices
| Design | Where TLS ends | Advantages | Trade-offs |
|---|---|---|---|
| Proxy termination | HAProxy; private origin hop may be HTTP. | One public certificate location, straightforward HTTP routing and health checks. | Requires correct forwarded-scheme and Host handling; protect the private network. |
| End-to-end TLS | HAProxy accepts TLS and connects to origins with HTTPS. | Encrypts traffic across the private hop and can satisfy stricter internal policy. | Origin certificates, verification and renewal become part of operations; health checks must use the right TLS settings. |
| TCP pass-through | WordPress origin. | HAProxy does not inspect or terminate application TLS. | HTTP-layer redirects, headers and content-aware checks are unavailable or limited, and certificate management is distributed. |
Whichever model you choose, keep the public hostname and certificate identity consistent. If origins use HTTPS, configure certificate verification and name matching rather than silently accepting any certificate.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Deploy and validate in a controlled sequence
- Prepare both origins. Confirm identical code, PHP configuration, web-server rules, database visibility, media mounts, cache settings and trusted proxy restrictions. Test the public hostname behavior against each origin through a temporary controlled route if available.
- Implement the health endpoint. Request it directly on each origin with the expected Host header. Confirm that a working origin returns 200 and that an intentionally broken PHP or web path does not falsely report success.
- Install the HAProxy configuration. Replace example certificate paths, addresses and hostname values. Review network ACLs so only intended listeners are exposed.
- Run the installed version’s syntax checker before reload. A common form is
haproxy -c -f /etc/haproxy/haproxy.cfg; use the command and service procedure supplied by your distribution and installed version. - Start with one origin if necessary. Verify TLS negotiation, the single redirect from HTTP, the forwarded Host and scheme, and WordPress’s canonical URL before adding the second server.
- Add the remaining origin. Query the health endpoint through HAProxy and inspect HAProxy logs to confirm that both servers enter rotation. Log the selected backend for troubleshooting, but do not expose sensitive forwarding headers to visitors.
- Exercise production paths. Test anonymous pages, canonical and media URLs, the REST API, administrator login, plugin updates, uploads, cache purge and scheduled jobs through the public hostname.
- Run a failure drill. Stop or isolate one origin, refresh anonymously and while logged in, and verify that the remaining origin serves correctly. Check that the unhealthy node leaves rotation and that clients do not receive an endless redirect.
- Restore carefully. Bring the node back only after code, database visibility, media, cache state and health checks are consistent. Watch logs while it re-enters service.
Troubleshoot common failures
| Symptom | Likely cause | What to inspect |
|---|---|---|
| Browser reports too many redirects | WordPress does not recognize the original HTTPS scheme, or the canonical URL differs by hostname. | HAProxy’s overwritten X-Forwarded-Proto, the $_SERVER['HTTPS'] logic, WP_HOME, WP_SITEURL and the forwarded Host. |
| Links point to an internal server name | The public Host was not preserved or WordPress is using an origin URL from its database. | Request and response headers, server-name rules and the two URL constants. |
| One origin is marked down despite serving pages | The check URI, Host header, method or expected status does not match the endpoint. | Directly issue the same HEAD request to the origin and inspect HAProxy check logs. |
| Images disappear intermittently | Uploads exist only on the origin that handled the upload. | Mounts, replication lag, permissions and the exact path used by every origin. |
| Users lose a cart or admin session | PHP session files or plugin state are local to one node. | Plugin session design, shared session storage and whether persistence is actually required. |
| New content appears only on some requests | Object or page caches are not shared or purged consistently. | Cache backend, purge hooks, deployment procedure and origin-specific cache directories. |
| Scheduled tasks run twice | Each origin is running WP-Cron independently. | Disable uncontrolled per-request cron execution and use one controlled scheduler where appropriate. |
| Failover works for visitors but not for administrators | Admin, upload or REST paths rely on local files, sessions or a plugin unavailable on the surviving node. | Run the failure drill while authenticated and test every write path, not just the home page. |
Availability of HAProxy itself
Two WordPress origins do not remove a single HAProxy node as a single point of failure. If the proxy host, its public address, certificate store or network path fails, both origins can be healthy and still unreachable. A production design may require redundant HAProxy instances, a failover address, replicated configuration and certificate automation. The exact mechanism depends on your network and hosting environment; validate failover rather than assuming it.
| Comparison axis | Single HAProxy | Redundant HAProxy pair or equivalent |
|---|---|---|
| Proxy failure impact | One proxy outage takes the public site offline. | A surviving proxy can continue if the public address and state transfer are correctly handled. |
| Certificate management | One certificate store and renewal path. | Certificates and private keys must be synchronized or independently renewed. |
| Observability | One log and metrics stream. | Logs, health state and configuration drift must be compared across proxies. |
| Operational complexity | Lower. | Higher; failover, split-brain and configuration consistency require drills. |
What to measure instead of guessing
There is no universal WordPress throughput, latency or uptime number for this design. The useful values depend on PHP workers, database capacity, cache hit rate, media storage, network distance, health-check thresholds and plugin behavior. Measure your own deployment: request latency by URL class, origin error rates, health-check transitions, open connections, PHP saturation, database waits, cache hit rate and upload success. Load-test both normal operation and the loss of one origin, and include authenticated and write-heavy workflows.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Production readiness checklist
- One canonical public hostname and a valid certificate are configured at the intended TLS boundary.
- HAProxy overwrites forwarded scheme and host headers, and origins accept traffic only from trusted proxy addresses.
- Health checks exercise a lightweight application path and remove failed origins from rotation.
- Both origins use the same WordPress code, plugins, themes, PHP settings and web rules.
- The database, uploads, object cache, sessions and cron design are explicitly documented and tested.
- Round-robin is used unless a demonstrated session requirement justifies a named persistence cookie.
- HTTP redirects once to the public HTTPS URL; canonical, media, REST and admin URLs use the public hostname.
- Anonymous, authenticated, upload, update, cache-purge and scheduled-job paths have been tested through HAProxy.
- The configuration passes the installed HAProxy version’s syntax check before every reload.
- One-origin failure and restoration drills have been completed, including observation of logs and health transitions.
- The HAProxy host itself has a documented availability plan if the site requires more than one proxy failure domain.
Decision
Use HAProxy with round-robin backends when your WordPress origins are genuinely interchangeable and their state is shared. Correct the forwarded scheme and Host handling before troubleshooting redirects, make health checks application-aware, and treat uploads, sessions, caches, cron and the database as first-class cluster components. Add persistence only for a measured application need, then test node loss while users are logged in and while content is being written.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
