Redirect HTTP to HTTPS on WordPress

Why it matters

Visitors who type the bare domain or follow an old link land on the unencrypted site and stay there. A permanent redirect sends every http request to the same page over https.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: set WordPress Address and Site Address to https:// (Settings, General, or the HTTPS button in Tools, Site Health) and check the site works.
2. Stage 2: redirect at the layer in front of WordPress; many hosts have a Force HTTPS switch. Behind Cloudflare, use Always Use HTTPS and do not add the .htaccess rules, which loop under Flexible mode. On Apache without a CDN, add the rules at the top of .htaccess, above BEGIN WordPress.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Serve the site over HTTPS
• Stop redirecting HTTPS to HTTP
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Redirect HTTP straight to HTTPS
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS