How to force the root domain over https without a 301 redirection?

Question

My Goal: My goal is for new users who have never visited my page, and who are unlikely to explicitly type https:// in front of my-domain.com to land on the https://my-domain.com with a response code of 200 instead of landing on the http://my-domain.com first, and then be 301 redirected to the https://my-domain.com version, which is also cached.

My situation: I am undergoing an attempt to optimize all the WordPress sites I am the manager of. Many of those have the Really Simple SSL plugin installed and activated, mostly for addressing mixed content issues. I decided to uninstall the plugin on two of them, after reading an article (link) on potential performance decreases caused by it, which I wanted to put to the test. Apart from fixing mixed content, this plugin is also responsible for introducing a PHP or .htaccess 301 redirection. Since I was on Apache, and now LSWS, I had the .htaccess one enabled.

What I've tried so far: I started by deactivating the plugin, and temporarily reverting to http to erase all of the plugin's marks. I then deleted the plugin completely from the installation. That resulted in the home_URL and site_URL conversion to http, which I manually edited to https once again. Then ran a DB search/replace for every http:// instance to become an https:// one

Next I had the cPanel checked under Domains, where I enabled the Force HTTPS option there, and had the SSL status checked to verify there were no issues there (everything was green). I checked the .htaccess file to exclude the presence of any 301 remnants, and had the cache purged just in case. I did all of the above for both installations individually.

After all of that I visited URL my-domain-1.com and my-domain-2.com from a new chrome incognito session. I noticed that my-domain-1.com loads under https:// with a 200 response code, while my-domain-2.com still loads under http:// at first, and is then being redirected to https://, which has left me confused.

What should I have done differently, or what is it that I have been missing?

Answer 1

When a user types in a website URL without explicitly typing https, most web browsers will initially attempt to connect over http (though as Patrick mentioned, this is beginning to change - see Chrome and Firefox).

Currently, the only way to communicate to web browsers to never attempt to load your website over http, even the very first time they ever load your site, is to submit your domain for HSTS preload list inclusion.^[1] The HSTS preload list is a list of websites that gets hard-coded into Chrome, Firefox, Safari, Edge, etc. that tells the browsers not to load your website over http, even when the browser is freshly downloaded and knows nothing else about your website at all.

I am not sure HSTS preloading is strictly necessary or offers much benefit in your setup (it won't offer any performance benefit after the initial connection compared to non-preloaded HSTS, since HSTS gets cached whether or not it is preloaded), but it is the only answer to your very specific question as asked. In other words, HSTS preloading is the only way to force https for first-time visitors who type your domain into their address bar without explicitly typing the https, aside from issuing a redirect over an initial http connection.

^{[1] Some entire TLDs are already on the HSTS preload list, such as .dev, but if your website's TLD were on that list, then you wouldn't be seeing this issue with it.}