Force Wordpress https redirect before www redirect based on site address url

Question

The default web address for a domain is:

https://www.example.com

If I set this as the 'Site Address (URL)' in Wordpress then it seems to take care of the necessary http -> https and non-www -> www redirection on it's own.

The problem is though is that Wordpress redirects the following first:

http://example.com to http://www.example.com

Before this one:

http://example.com to https://example.com

Which means that our HSTS preload status and eligibility is failing which we check here.

We are needing to ensure that the https redirect happens BEFORE the www redirect.

---

I have no idea how best to do this but I would probably prefer some sort of theme function that hooks into the default functionality and modifies it accordingly.

I did try setting the default site address to http://example.com and then handling the https and www redirect in the .htaccess but this doesn't seem ideal and can get messy (plus I could only get the https redirect to work and not the www redirect afterwards).

Surely there must be plenty of other HSTS eligible Wordpress websites that use a default https://www start to the website?

Answer 1

Just do it in your .htaccess, it will be alot simpler. The important thing is that the rules are above WordPress' rules. Setting L also states, that this shall be the last rule evaluated if a match was found

# Redirect to https
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]

# Redirect non-www to www
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule (.*) https://www.example.com/$1 [R=301,L]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

Answer 2

# Redirect to https
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]

# Redirect non-www to www
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule (.*) https://www.example.com/$1 [R=301,L]

Just tried it and it worked fine. Just remember to also set Wordpress Address and Site Address in Wordpress. I think the infinite loops "in above comments" came from that.

Always test the main url and then also one like example.com/about.html, as I have picked up sometimes that the root domain redirects well, but by having the pages added, it gives problems if redirects not done correctly.

Feel free to reply on my comment.

Answer 3

If anyone else is struggling to get their Wordpress website (as default address https://www) to pass the HSTS preload check for subdomains so you can submit your site to the browser preload list of sites, then I eventually managed to get this resolved by using this plugin that I referred to in my answer above. This handles all https redirection across Wordpress and does it well so Wordpress can't interfere with anything.