We've got a website that is served on both
www.example.com and just
example.com - we've never done any sort of forcing users from one domain to the other, so if they land on
example.com then that's where they stay, and I'm guessing that of those who bookmark our pages they'd be about a 50/50 split (there was an issue earlier on where some of our material omitted the WWW and years later we're still noticing a traffic split).
We're now adding SSL. We're not forcing SSL until the user hits the login or register page. Which domain should we run our SSL on?
- Something else?
I've done plenty of SSL sites before, but they were always designed with SSL in mind, and we always forced the www subdomain.
Are there pros and cons of doing it any of those ways? My primary concern is about the recognition of cookies, but seeing as we're forcing SSL on logon, the session cookie will be written on the SSL'd domain anyway. My primary concern is for people who might go to
https://example.com when we're running the site on
Another question would be, "Should I rewrite those who land on the non-www site to the WWW site?