0

The default web address for a domain is:

https://www.example.com

If I set this as the 'Site Address (URL)' in Wordpress then it seems to take care of the necessary http -> https and non-www -> www redirection on it's own.

The problem is though is that Wordpress redirects the following first:

http://example.com to http://www.example.com

Before this one:

http://example.com to https://example.com

Which means that our HSTS preload status and eligibility is failing which we check here.

We are needing to ensure that the https redirect happens BEFORE the www redirect.


I have no idea how best to do this but I would probably prefer some sort of theme function that hooks into the default functionality and modifies it accordingly.

I did try setting the default site address to http://example.com and then handling the https and www redirect in the .htaccess but this doesn't seem ideal and can get messy (plus I could only get the https redirect to work and not the www redirect afterwards).

Surely there must be plenty of other HSTS eligible Wordpress websites that use a default https://www start to the website?

3 Answers 3

1

Just do it in your .htaccess, it will be alot simpler. The important thing is that the rules are above WordPress' rules. Setting L also states, that this shall be the last rule evaluated if a match was found

# Redirect to https
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]

# Redirect non-www to www
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule (.*) https://www.example.com/$1 [R=301,L]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
10
  • When I try this (which I had already tried), the site fails to load due to "too many redirects". I can get an https redirect to work in the .htaccess but it just doesn't like a subsequent www redirect for some reason.
    – zigojacko
    Nov 16, 2018 at 9:41
  • @zigojacko Is WordPress set to https & www? Where is it redirecting you? This setup works in regular configuration, there might be something else that creates the many redirects
    – kero
    Nov 16, 2018 at 10:12
  • If I add the redirects in .htaccess then I am making the Wordpress settings address http://example.com but the actual address we want to use is https://www.example.com (and ideally this is what we would have set in the Wordpress settings). I think the issue with the 'too many redirects' is that when in settings, you've omitted the 'www', Wordpress by default will try and redirect any request to the non-www so with the www redirect in .htaccess, it's creating a redirect loop.
    – zigojacko
    Nov 16, 2018 at 10:18
  • 1
    Well, after a lot of messing about with various rewrites and configuration, I eventually tried this plugin which does everything necessary behind the scenes and with the .htaccess Strict-Transport-Security header set, HSTS eligibility passes with no errors/warnings and can now be submitted to the browser preload list... :)
    – zigojacko
    Nov 16, 2018 at 11:17
  • 1
    @zigojacko Happy to hear you found a solution. Feel free to answer your own question - so future visitors can see it better
    – kero
    Nov 16, 2018 at 11:38
1
# Redirect to https
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]

# Redirect non-www to www
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule (.*) https://www.example.com/$1 [R=301,L]

Just tried it and it worked fine. Just remember to also set Wordpress Address and Site Address in Wordpress. I think the infinite loops "in above comments" came from that.

Always test the main url and then also one like example.com/about.html, as I have picked up sometimes that the root domain redirects well, but by having the pages added, it gives problems if redirects not done correctly.

Feel free to reply on my comment.

0

If anyone else is struggling to get their Wordpress website (as default address https://www) to pass the HSTS preload check for subdomains so you can submit your site to the browser preload list of sites, then I eventually managed to get this resolved by using this plugin that I referred to in my answer above. This handles all https redirection across Wordpress and does it well so Wordpress can't interfere with anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.