2

I have a WordPress install on a subdomain: https://blog.example.com

To enforce SSL I have the following redirects in my .htaccess:

<IfModule mod_rewrite.c>
RewriteEngine On

# BEGIN FORCE HTTPS
RewriteCond %{SERVER_PORT} !^443$
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301]
# END FORCE HTTPS

# BEGIN WordPress
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress

</IfModule>

This used to work until a while ago. Now, when calling http://blog.example.com, I get:

Moved Permanently

The document has moved here.

Additionally, a 500 Internal Server Error error was encountered while trying to use an ErrorDocument to handle the request.

The word "here" in line 2 links to http://blog.example.com.

What's wrong with the .htaccess?

I checked the WordPress settings and they are not the problem: The site URL is correctly set to https://blog.example.com.

1

I was able to resolve it by changing the .htaccess like so:

<IfModule mod_rewrite.c>
RewriteEngine On

# BEGIN FORCE HTTPS
RewriteCond %{HTTPS} !=on
RewriteCond %{ENV:HTTPS} !=on
RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]*
# END FORCE HTTPS

# BEGIN WordPress
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress

</IfModule>
  • 1
    Presumably the * at the end of the RewriteRule directive is a typo? (As that would result in a 500 error.) If you are now having to check ENV:HTTPS then that suggests the SSL implementation on your server has changed (possibly now handled by a front-end proxy?). But if that's the case then you should remove the condition that checks %{HTTPS} - since this check is redundant. – MrWhite Oct 31 '17 at 17:53
1

This is really additional information since you appear to already have found your solution, but anyway...

RewriteCond %{SERVER_PORT} !^443$
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301]

I don't think this would ever have worked as intended since you are missing the L (last) flag on the RewriteRule. If this appeared to be "working" before then I would guess WordPress itself was actually issuing the appropriate redirect?

Since the L flag is omitted here, the rewrite engine would have continued on to your front controller and internally rewritten the URL to index.php. Unless WordPress was stepping in, this would have resulted in a 301 status code being returned to the client, but without a Location HTTP response header (required for the external redirect). This could have been potentially damaging for SEO.

However, by itself, this does not explain the redirect loop. That is possibly because of a change in the SSL implementation on your server, which your answer suggests.

  • 1
    I always thought that [R] implied [L], but the documentation says that you almost always should use them together. – Stephen Ostermiller Oct 31 '17 at 19:55
  • @StephenOstermiller Using R without L is nearly always an error/oversite in my experience. If it doesn't actually result in an error then it's likely to be less efficient. A couple of related questions: stackoverflow.com/questions/46650964/… and webmasters.stackexchange.com/questions/85563/… - AFAIK the only flags that imply L are F, G, P and PT (although PT is superfluous in .htaccess, it still implies L). – MrWhite Nov 2 '17 at 15:19
0

Since you are using WordPress, you could always change the wp_options table's first two entries to your https domain.

Another way to achieve this is to add Site Home and WP Home in the wp-config.php file. Here is the link to the relevant codex.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.