0

I've created a plugin that turns all links into protocol relative URLs, like so:

http://example.com -> //example.com

I'm also adding a function to force HTTPS only if SSL is enabled and set up properly on the website. The following function below will force HTTPS regardless if it has been set up correctly:

add_action ( 'template_redirect', 'force_https', 1 );
function force_https() {
    if ( ! is_ssl() ) {
        wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], 301 );
        exit();
    }
}

However, if SSL hasn't been configured for the website, it will cause a connection error and the user won't be able to access their website. This is where I want to put a check before it executes the wp_redirect().

My idea is to check if the get_home_url() option has https:// in the URL:

if ( preg_match( '/https:\/\//', site_url() ) && ! is_ssl() ) {

Is there a better way to check? Or is it not even necessary to force HTTPS if my first function from my plugin has made all of the links protocol-relative?

  • Take a look at the source code for is_ssl(); it is also testing the $_SERVER global so not sure you also need to do that. Also, I believe this is ok for the vast majority of cases but some server configs might not play nicely with the way the global gets set. Is an alternative to force your user to select an option that says "yes, I am using SSL", in your plugin settings page? (edit) one more point - you can always use protocol-relative URL references in your plugin. E.g.: "//foo.com/folder/resource..." and avoid any hard-coding of protocol. – C C Oct 7 '16 at 19:03
  • @CC Actually, my plugin does enforce protocol-relative URL, which can be found here. So would forcing SSL not be necessary? – Ethan Jinks O'Sullivan Oct 7 '16 at 19:51
  • I would imagine that WP is handling the rewrite rules to serve as https when a request comes in with no protocol stated, if the site is set up as https. Maybe I'm missing something else -- so why do feel there is a need to try to force SSL by prepending https to URIs (?). As long as your plugin is scanning stored content and not doing something like trapping the output buffer and modifying it, then I think simply removing the protocol from hard-coded links is enough. Again, this is just my theory...would need to be tested. – C C Oct 7 '16 at 20:39
  • @CC I think you're right, since all of the URLs will have // (protocol-relative), it's a matter of making sure the home/site URL is set up with HTTPS to enforce SSL. – Ethan Jinks O'Sullivan Oct 10 '16 at 15:09
  • glad I could help provide you with an answer. – C C Oct 10 '16 at 20:03
1

There is no fail proof way to know if the site support https without actually trying to send a request over https to it (wp_get_remote for example). HTTPS traffic can be terminated on a load balancer and the traffic between it and wordpress done over http, therefor it is not obvious you will find any HTTPS specific configuration (there has to be one somewhere, but it will change from site to site).

  • I'm with Mark on this. You don't describe your reasons for forcing SSL, but wouldn't it be better to disable the functionality you want to protect in a graceful way if you detect that SSL isn't currently being used? – Andy Macaulay-Brook Oct 7 '16 at 19:45
  • @AndyMacaulay-Brook I've updated my question – Ethan Jinks O'Sullivan Oct 7 '16 at 20:02
  • @MarkKaplun I see, I think my best bet is to check if the user set the site URL with HTTPS in it then. – Ethan Jinks O'Sullivan Oct 7 '16 at 20:04
  • @EthanJinksO'Sullivan, since it is a plugin, there are to things you can use, an explicit setting, and the fact that by installing the plugin a user want the functionality. – Mark Kaplun Oct 8 '16 at 10:22
0

Based on the comments, there is no foolproof way to check if someone's website has SSL set up correctly. Possible options include a setting in the plugin to have the user confirm that they have SSL set up.

However, one automated way is to check if the site URL has https:// in it. This is assumed that SSL has been set up properly by the user since the website wouldn't load correctly if they try to set the domain with HTTPS:

add_action( 'template_redirect', 'wpse_241934_redirect_https', 1, 1 );
function redirect_https() {
    # If 'https://' is in the website's site URL and SSL is not being used, force HTTPS
    if ( preg_match( '/https:\/\//', site_url() ) && ! is_ssl() ) {
        wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], 301 );
        exit;
    }
}

For me, this function wouldn't be necessary since my plugin makes all URLs protocol-relative. This could still be helpful for anyone else who wants to execute a function if a website is running SSL only.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.