Skip Navigation


Reported for: WPML Multilingual CMS 4.3.14

Resolved in: WPML Multilingual CMS 4.4.3

Overview of the issue

The issue here could happen for a REST Api call, when you use “Different domains per language” setting in WPML > Languages and Nginx server configured with server_name that does not match your domain name.



$url_parts['host'] = filter_input( INPUT_SERVER, 'SERVER_NAME', FILTER_SANITIZE_URL )
            ?: filter_input( INPUT_SERVER, 'HTTP_HOST', FILTER_SANITIZE_URL );

in wp-content/plugins/sitepress-multilingual-cms/classes/url-handling/converter/strategy/class-wpml-url-converter-domain-strategy.php

$url_parts['host'] = filter_input( INPUT_SERVER, 'HTTP_HOST', FILTER_SANITIZE_URL )
            ?: filter_input( INPUT_SERVER, 'SERVER_NAME', FILTER_SANITIZE_URL );

8 Responses to “Possible issues with "Different domains per language" setting when doing a REST api call”

  1. Hallo,

    i fix this, i Replacing SERVER_NAME with HOST_NAME in the file.

    But still it not working: From Czech ( -> English ( does not work

    English ( => DE and CZ working good
    Deutsch ( => EN and CZ working good

    please can you check it again ?

    Thanks for reply

    • Can you verify that you replaced $_SERVER[‘SERVER_NAME’]; with $_SERVER[‘HTTP_HOST’]; as you said you replaced it with: HOST_NAME and that probably does nothing.

      If you still have issues, I suggest to open a new ticket, so that we can investigate your issue.

  2. somehow I made a mistake when pasting above, here it’s correct:

    $url_parts['host'] = '';
    if ( !empty( $_SERVER['SERVER_NAME'] ) ) {
    $url_parts['host'] = sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) );
    } elseif ( !empty( $_SERVER['HTTP_HOST'] ) ) {
    // see
    $url_parts['host'] = sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) );

  3. I can confirm that this change indeed fixes a situation where there is a main domain with aliases for the language domains. For example in Nginx config:


    A on request on, $_SERVER[‘SERVER_NAME’] will return A REST request from to is blocked by CORS. Using $_SERVER[‘HTTP_HOST’] will return which is correct.

    But a warning should be given here: $_SERVER[‘HTTP_HOST’] uses the ‘Host:’ field from the HTTP request header and therefore can be influenced from the outside although it is on the list of forbidden headers that can be changed programatically (by Javascript).

    I believe patching this therefore is the better solution.

  4. Any news on the release date of this rather simple fix?

    With the last automatic WPML update the WP API broke again rendering the site unusable for a couple of hours for our users and editors until this fix was manually applied again.