10

I installed MultiSite with the URL set as http://example.com, but now I want to force all requests to go over HTTPS, so I'm trying to change the URL to be https://example.com. I've gone through the database and updated all the siteurl and home values to have https, but the site still loads over HTTP, instead of being redirected to HTTPS.

I know that I could setup some htaccess rules, but that's prone to errors. In regular installations WordPress will automatically redirect all requests to the canonical URLS defined in the siteurl and home settings, so I'm assuming that MultiSite does too.

1

There are plugins to set the site to SSL. Why not use one of them?

And you do have an SSL certificate installed and active?

  • All of the plugins I've seen are to set specific pages to use HTTPS, not the entire site. In regular WP installations the normal method for making the entire site use HTTPS is to set the siteurl and home values. Even if there were some available, there are several reasons why using a plugin is a bad idea when you can just set a config value (security, performance, etc). Also, I'm pretty confident that it doesn't matter if the SSL cert is yet or not. WordPress isn't going to check that when it determines what the canonical URL is. – Ian Dunn Apr 10 '12 at 15:59
  • True and true, I was just wondering if you already had it setup or not (loads of people don't know you need an SSL cert if you truly want to use SSL, hence the Q). I just remembered I had a site of mine in SSL a while back (not just specific pages, but the whole site as you want it). I'll lookup the code. – Hiranthi Apr 18 '12 at 12:24
  • Hmm.. couldn't find the code I used back then. However, I did find this: prosauce.org/blog/2010/08/… – Hiranthi Apr 18 '12 at 12:32
  • I installed Better WP Security for a different reason, but it turns out that it has an option to force all page requests (front and back) to go over SSL. – Ian Dunn Apr 18 '12 at 14:54
  • The best solution would be the one that uses no plugin IMHO. That way each request doesnt have to be parsed by the plugin. – captainblack Feb 21 '18 at 1:10
3

I encountered the same issue: with WordPress multisite, there is no option or setting that defines if a site domain is HTTP or HTTPS. Even after replacing all occurrences in the database, a site visitor can still enter and navigate the site in HTTP, without being redirected to HTTPS.

The following simple solution worked for me: I added this mod_rewrite rule to my .htaccess file, just before the WordPress specific rewrite rules.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Since this rule isn't defining a specific domain, it's perfect for the needs of WordPress multisite.

I found this rule in the following thread: https://stackoverflow.com/questions/4398951/force-ssl-https-using-htaccess-and-mod-rewrite

  • This type of solution is excellent for a multisite that is protocol homogenized. Once you wish to have a mix of SSL and non-SSL sites in a multisite network things get complicated. Very complicated. – C C Dec 9 '16 at 2:35
  • Indeed, my context was a network where I switched all sites to SSL at the same time. – Manu Dec 10 '16 at 6:45
  • Putting it before the WordPress specific rules solved it for me. Thanks - this solution took me a while to find. – bastelflp Mar 5 '18 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.