Only execute function if SSL is set up properly

Question

I've created a plugin that turns all links into protocol relative URLs, like so:

http://example.com -> //example.com

I'm also adding a function to force HTTPS only if SSL is enabled and set up properly on the website. The following function below will force HTTPS regardless if it has been set up correctly:

add_action ( 'template_redirect', 'force_https', 1 );
function force_https() {
    if ( ! is_ssl() ) {
        wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], 301 );
        exit();
    }
}

However, if SSL hasn't been configured for the website, it will cause a connection error and the user won't be able to access their website. This is where I want to put a check before it executes the wp_redirect().

My idea is to check if the get_home_url() option has https:// in the URL:

if ( preg_match( '/https:\/\//', site_url() ) && ! is_ssl() ) {

Is there a better way to check? Or is it not even necessary to force HTTPS if my first function from my plugin has made all of the links protocol-relative?

Answer 1

There is no fail proof way to know if the site support https without actually trying to send a request over https to it (wp_get_remote for example). HTTPS traffic can be terminated on a load balancer and the traffic between it and wordpress done over http, therefor it is not obvious you will find any HTTPS specific configuration (there has to be one somewhere, but it will change from site to site).

Answer 2

Based on the comments, there is no foolproof way to check if someone's website has SSL set up correctly. Possible options include a setting in the plugin to have the user confirm that they have SSL set up.

However, one automated way is to check if the site URL has https:// in it. This is assumed that SSL has been set up properly by the user since the website wouldn't load correctly if they try to set the domain with HTTPS:

add_action( 'template_redirect', 'wpse_241934_redirect_https', 1, 1 );
function redirect_https() {
    # If 'https://' is in the website's site URL and SSL is not being used, force HTTPS
    if ( preg_match( '/https:\/\//', site_url() ) && ! is_ssl() ) {
        wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], 301 );
        exit;
    }
}

For me, this function wouldn't be necessary since my plugin makes all URLs protocol-relative. This could still be helpful for anyone else who wants to execute a function if a website is running SSL only.