Steps for WordPress over SSL

Question

There are several guides online (Wpmudev, CSS Tricks & WP Beginner) that take you through the steps which are involved in making your WordPress site work with an SSL certificate.

Each guide talks about adding the following to wp-config.php to enable SSL within WP Admin:

define('FORCE_SSL_ADMIN', true);

The guides also recommend forcing an SSL rewrite via .htaccess. Something along the lines of:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

I've run a search and replace on the database, replacing all instances of http:// to https://. As this is the case, do I really need to add the additional snippets to wp-config.php and .htaccess?

The site works perfectly with SSL with the search and replace method that I have used. I've just added the following to my wp-config.php file to prevent any re-direct loops.

$_SERVER['HTTPS'] = 'on';

It's also important to note that this site has had SSL from the beginning, so I guess the 301 re-direct via .htaccess isn't required.

I just want to ensure that the recommended snippets do not serve any other purpose that I may have missed.

Answer 1

It is not absolutely necessary to add anything to the config file. However it's a good idea to do a test to look for any unsecured Http calls, such as stylesheets or Scripts. A good resource for this is https://www.whynopadlock.com/.

The force SSL Setting can sometimes help with requests coming from plug-ins or anything you may have had coded that is prefixed by an unsecured http://.

However the bottom line is as long as you are requesting any internal http (as opposed to https) addresses, you should be fine.