I maintain a retail store's eCommerce website, provided by a 3rd party. The HTTPS links do not load ('ERR_CONNECTION_TIMED_OUT') unless you put in the WWW before the doman name. The HTTP links forward to their respective www counterparts. This 3rd party has explained that HTTPS links would need to be forwarded to the
www URLs as well but "Webforwards do not forward https." I am left with a sense that this will not be followed up on. Practically speaking, I don't think we will have any shoppers manually going in and typing
https://store.com and encountering this issue. However, it doesn't seem to be good practice. I checked google, yahoo, bing, shopify, and bankofamerica all forward you to their www if you do just https://domain.com. What makes this not commonplace? It looks like Amazon forwards you to their standard http if not on a need-to-be-secure page.
Is there a security hole that could arise as a result of forwarding
https://example.com requests to
https://www.example.com? Why would anyone want to have an error when you could have it forward to somewhere?