I installed MultiSite with the URL set as http://example.com, but now I want to force all requests to go over HTTPS, so I'm trying to change the URL to be https://example.com. I've gone through the database and updated all the siteurl and home values to have https, but the site still loads over HTTP, instead of being redirected to HTTPS.

I know that I could setup some htaccess rules, but that's prone to errors. In regular installations WordPress will automatically redirect all requests to the canonical URLS defined in the siteurl and home settings, so I'm assuming that MultiSite does too.

3 Answers 3


There are plugins to set the site to SSL. Why not use one of them?

And you do have an SSL certificate installed and active?

  • All of the plugins I've seen are to set specific pages to use HTTPS, not the entire site. In regular WP installations the normal method for making the entire site use HTTPS is to set the siteurl and home values. Even if there were some available, there are several reasons why using a plugin is a bad idea when you can just set a config value (security, performance, etc). Also, I'm pretty confident that it doesn't matter if the SSL cert is yet or not. WordPress isn't going to check that when it determines what the canonical URL is.
    – Ian Dunn
    Apr 10, 2012 at 15:59
  • True and true, I was just wondering if you already had it setup or not (loads of people don't know you need an SSL cert if you truly want to use SSL, hence the Q). I just remembered I had a site of mine in SSL a while back (not just specific pages, but the whole site as you want it). I'll lookup the code.
    – Hiranthi
    Apr 18, 2012 at 12:24
  • Hmm.. couldn't find the code I used back then. However, I did find this: prosauce.org/blog/2010/08/…
    – Hiranthi
    Apr 18, 2012 at 12:32
  • I installed Better WP Security for a different reason, but it turns out that it has an option to force all page requests (front and back) to go over SSL.
    – Ian Dunn
    Apr 18, 2012 at 14:54
  • 1
    The best solution would be the one that uses no plugin IMHO. That way each request doesnt have to be parsed by the plugin. Feb 21, 2018 at 1:10

I encountered the same issue: with WordPress multisite, there is no option or setting that defines if a site domain is HTTP or HTTPS. Even after replacing all occurrences in the database, a site visitor can still enter and navigate the site in HTTP, without being redirected to HTTPS.

The following simple solution worked for me: I added this mod_rewrite rule to my .htaccess file, just before the WordPress specific rewrite rules.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Since this rule isn't defining a specific domain, it's perfect for the needs of WordPress multisite.

I found this rule in the following thread: https://stackoverflow.com/questions/4398951/force-ssl-https-using-htaccess-and-mod-rewrite

  • This type of solution is excellent for a multisite that is protocol homogenized. Once you wish to have a mix of SSL and non-SSL sites in a multisite network things get complicated. Very complicated.
    – C C
    Dec 9, 2016 at 2:35
  • Indeed, my context was a network where I switched all sites to SSL at the same time.
    – Manu
    Dec 10, 2016 at 6:45
  • Putting it before the WordPress specific rules solved it for me. Thanks - this solution took me a while to find.
    – bastelflp
    Mar 5, 2018 at 17:28

I changed the rules specific to a host. But now redirects all other blogs to this one. Changed to "%{HTTP_HOST}" to a specific domain and kept the "%{REQUEST_URI}" part.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://gezentiyiz.biz%{REQUEST_URI} [L,R=301]

IMHO adding additional RewriteRule lines for other domains may solve the problem but I wonder is there any easy way to do it. Because each time a blog site is created we need to modifiy the .htaccess file???

Edit: I solved the problem changing the RewriteRule like this:

RewriteRule http://gezentiyiz.biz%{REQUEST_URI} https://gezentiyiz.biz%{REQUEST_URI} [L,R=301]
  • "Changed %{HTTP_HOST} to a specific domain" - But why? This sounds like a different question, rather than an "answer"? Are you trying to be selective and only redirect certain sites to HTTPS?? "I solved the problem changing the RewriteRule like this" - Except that rule doesn't make sense and would not do anything!? To make the rule dependent on the hostname, you need to check the requested HTTP Host header (HTTP_HOST Apache server variable) in a separate condition (RewriteCond directive).
    – MrWhite
    Apr 19, 2023 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.