0

The default web address for a domain is:

https://www.example.com

If I set this as the 'Site Address (URL)' in Wordpress then it seems to take care of the necessary http -> https and non-www -> www redirection on it's own.

The problem is though is that Wordpress redirects the following first:

http://example.com to http://www.example.com

Before this one:

http://example.com to https://example.com

Which means that our HSTS preload status and eligibility is failing which we check here.

We are needing to ensure that the https redirect happens BEFORE the www redirect.


I have no idea how best to do this but I would probably prefer some sort of theme function that hooks into the default functionality and modifies it accordingly.

I did try setting the default site address to http://example.com and then handling the https and www redirect in the .htaccess but this doesn't seem ideal and can get messy (plus I could only get the https redirect to work and not the www redirect afterwards).

Surely there must be plenty of other HSTS eligible Wordpress websites that use a default https://www start to the website?

1

Just do it in your .htaccess, it will be alot simpler. The important thing is that the rules are above WordPress' rules. Setting L also states, that this shall be the last rule evaluated if a match was found

# Redirect to https
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]

# Redirect non-www to www
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule (.*) https://www.example.com/$1 [R=301,L]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
  • When I try this (which I had already tried), the site fails to load due to "too many redirects". I can get an https redirect to work in the .htaccess but it just doesn't like a subsequent www redirect for some reason. – zigojacko Nov 16 '18 at 9:41
  • @zigojacko Is WordPress set to https & www? Where is it redirecting you? This setup works in regular configuration, there might be something else that creates the many redirects – kero Nov 16 '18 at 10:12
  • If I add the redirects in .htaccess then I am making the Wordpress settings address http://example.com but the actual address we want to use is https://www.example.com (and ideally this is what we would have set in the Wordpress settings). I think the issue with the 'too many redirects' is that when in settings, you've omitted the 'www', Wordpress by default will try and redirect any request to the non-www so with the www redirect in .htaccess, it's creating a redirect loop. – zigojacko Nov 16 '18 at 10:18
  • 1
    Well, after a lot of messing about with various rewrites and configuration, I eventually tried this plugin which does everything necessary behind the scenes and with the .htaccess Strict-Transport-Security header set, HSTS eligibility passes with no errors/warnings and can now be submitted to the browser preload list... :) – zigojacko Nov 16 '18 at 11:17
  • 1
    @zigojacko Happy to hear you found a solution. Feel free to answer your own question - so future visitors can see it better – kero Nov 16 '18 at 11:38
0

If anyone else is struggling to get their Wordpress website (as default address https://www) to pass the HSTS preload check for subdomains so you can submit your site to the browser preload list of sites, then I eventually managed to get this resolved by using this plugin that I referred to in my answer above. This handles all https redirection across Wordpress and does it well so Wordpress can't interfere with anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.