Redirect HTTP straight to HTTPS on WordPress
Why it matters
The first redirect from http:// goes to another http:// address, so the visitor's request travels unencrypted twice before reaching https. The name the visitor typed also never gets an HSTS header, which is only honoured over https.
The fix
- WordPress redirects to its Site Address, so an http:// Site Address makes the first hop stay on http. Set WordPress Address and Site Address to https:// in Settings, General.
- Redirect http to https at the server, host or CDN, so that redirect happens before WordPress runs.
Related
- Reported by the HTTP to HTTPS redirect check
- Serve the site over HTTPS
- Stop redirecting HTTPS to HTTP
- Redirect HTTP to HTTPS
- Fix the broken HTTPS redirect chain
- Shorten the redirect chain
- Fix the HTTP redirect chain
- Answer HTTP with a redirect to HTTPS
- Redirect www and apex to one host
- Make the www or apex name work over HTTPS
Scan your domain to see whether this applies to you.