6

I have recently changed 3-4 of my sites to Cloudflare SSL. After that, I went to General Settings on WordPress and changed URLs from HTTP to HTTPS.

And it redirects from HTTP to HTTPS without any issues. But I read many posts on various blogs and they all mention adding .htaccess redirect.

Is that really necessary? I'm confused as the redirect is already in place.

6

It's really to do with when the redirect occurs.

WordPress/PHP naturally occurs later than .htaccess, so the HTTP request has already passed to PHP before the redirect occurs.

.htaccess is processed at the very start of the request, before it is passed to PHP.

However, if you are using CloudFlare then you should create a page rule to redirect HTTP to HTTPS to avoid unnecessary hits on your application server.

From a security point of view, you want to redirect to HTTPS as soon as possible.

  • So if I am using Cloudflare, what do you suggest, Should I add a redirect on CloudFlare or on htaccess or let it stay like this, from WordPress? – V3King Jun 20 '18 at 11:07
  • If you are using CloudFlare then you should create a page rule to redirect HTTP to HTTPS. This would be the preferred method. However, you still need to configure HTTPS in WordPress. And setting HTTP to HTTPS in .htaccess is a good fallback. However, note that how you configure .htaccess depends on your CloudFlare SSL type. – DocRoot Jun 20 '18 at 12:11
2

What .htaccess achieves

In this case, .htaccess can be used to redirect the requests from http to https once they hit the origin server, before they get to wordpress.

Should I use this instead of cloudflare redirects

If you redirect on cloudflare instead of doing it with .htaccess then you can avoid having to hit the origin server which will speed up the redirect.

1

It's recommended that you update the site address for WordPress and let Cloudflare redirect HTTP to HTTPS with or without WWW. This way there's no need to use mod_rewrite which limits the server-side requests. See my blog entries below.

SOURCE: How to Enable SSL in the WordPress Dashboard

  • Login to WordPress as an administrator
  • On the left hand side, hover over settings and then click General
  • Change these options:
    • WordPress Address (URL) to https://www.example.com
    • Site Address (URL) to https://www.example.com
    • You will need to replace example.com with the actual name of your domain
  • Finally Click Save Changes

Your WordPress setup should now update the internal permalinks of both pages and assets. If you are getting mixed content warnings then you need to dig deeper, possibly in the content or the design of your WP theme.


SOURCE: Cloudflare Page Rule HTTPS 301 non-www to www

Login to Cloudflare and head over to the Page Rules section and here you will need to add 3 new page rules.

Rule 1. Redirect HTTP NON-WWW to HTTPS WWW

  • Click the Page Rules icon at the top of the screen
  • Click the Create Page Rule button
  • Enter http://example.com/* and obviously changing example domain with your own.
  • Under “Then the settings are:” click + Add a Setting
  • Click the dropdown list, find and click option “Forwarding URL”
  • Change the “Select Status Code” to 301 — Permanent Redirect
  • Add https://www.example.com/$1 in the box below, but obviously changing example domain once again with your own domain name
  • Click Save and Deploy

Rule 2. Redirect HTTP WWW to HTTPS WWW

  • Click the Page Rules icon at the top of the screen
  • Click the Create Page Rule button
  • Enter http://www.example.com/* and obviously changing example domain with your own.
  • Under “Then the settings are:” click + Add a Setting
  • Click the dropdown list, find and click option “Forwarding URL”
  • Change the “Select Status Code” to 301 — Permanent Redirect
  • Add https://www.example.com/$1 in the box below, but obviously changing example domain once again with your own domain name
  • Click Save and Deploy

Rule 3. Redirect HTTPS NON-WWW to HTTPS WWW

  • Click the Page Rules icon at the top of the screen
  • Click the Create Page Rule button
  • Enter https://example.com/* and obviously changing example domain with your own.
  • Under “Then the settings are:” click + Add a Setting
  • Click the dropdown list, find and click option “Forwarding URL”
  • Change the “Select Status Code” to 301 — Permanent Redirect
  • Add https://www.example.com/$1 in the box below, but obviously changing example domain once again with your own domain name
  • Click Save and Deploy
  • Note if you are limited on page rules, you can also do a "redirect any non-WWW to WWW" and "redirect HTTP WWW to HTTPS WWW". It potentially includes an extra redirect for non-http non-www users, but fits in 2 rules. – JakeSteam Jun 20 '18 at 13:17
  • 1
    Ya, you get 3 page rules for the free account. You can use Always use HTTPS as well but then you're adding an additional redirect. – Simon Hayter Jun 20 '18 at 14:25
  • If I just use Always use HTTPS and don't make this rules, would that be also fine? If I do that, should I still add redirect in htaccess file? – V3King Jun 20 '18 at 14:57
  • WordPress will naturally use a PHP redirect from NON-SSL to SSL if you update the site address within the WordPress settings page. Htaccess method redirects before PHP and Cloudflare redirects before both of those. Cloudflare is the best method because it reduces one request on your main server. If you use Cloudflare then you don't need to use htaccess, however, adding it won't harm it either because it'll not be used unless Cloudflare is disabled. – Simon Hayter Jun 20 '18 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.