Forcing SSL (Bad Theme coding)

Question

When using a 3rd party theme, some external dependancies are enqueued using the HTTP protocol, which is fine if you don't use SSL and if the child theme is allowing complete control over all of these elements, which in this case something is either being missed by myself or enqueued through another stylesheet - I've used grep via terminal to look for where this could be happening, without luck.

Unfortunately, I have found in some cases logic goes right out of the window when these themes have been built, and can't be forced to HTTPS through theme code (bar editting the parent theme, which defeats the point).

I had hoped there might be a way to force all (or be selective if need be) HTTP requests through HTAccess with something along the lines of:

RewriteEngine On 
RewriteCond %{HTTP_HOST} ^fonts.googleapis\.com [NC]
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://fonts.googleapis.com/$1 [R,L]

This does not work - unless I'm doing something glaring obviously wrong?

Has anyone encountered this before and found a solution?

On a side note, I thought it was best practice to enqueue without any prefix like so:

//fonts.googleapis.com

Is that correct?

Answer 1

I would recommend SSL Insecure Content Fixerplugin, which solves all mixed content problems. I use it successfully on numerous websites. No need for changes in your theme.

Answer 2

Usually, the issue with forcing SSL comes from external requests, which, should have nothing to do with your .htaccess file. That should be only dealing with requests that come INTO your site, not requests that go out from it.

Your second instinct was correct, as far as I've seen and have researched, the // method uses your current method of requesting to request the external resource. So, if you're making a request call through http://, it will mirror your initial request through http:// and same goes for https://.

As for fixing a theme or a child theme, if the theme was built correctly, it should be using wp_enqueue_script or wp_enqueue_style to implement the external calls (hopefully they are not printing them out in HTML in the header).

IF you know the name of the scripts, might I suggest running a child theme or an mu-plugin and then dequeuing & re-enqueuing the style or script in question: https://themify.me/docs/enqueue-scripts

Since there aren't any specific examples, I'm not sure if I can provide any more code than what I've already linked to.

I hope you find this useful.