HTTPS site on Chrome with paid SSL showing as Dangerous

Question

I built a WordPress STAGING site on projectjustcause.com domain. I have installed and tested paid SSL cert and it worked fine. When I added directives to APACHE 2.4 .htaccess file to forward all http requests to https, the whole site works except the wells page:

https://projectjustcause.com/wells

In Chrome, I get the "Deceptive site ahead" red page warning.

However, the page loads fine in Firefox.

Further, if I click to approve the site as safe, the URL bar displays "Dangerous" where the padlock should be.

HTACCESS

Here is what the .htaccess file looked like before I added my HTTPS forwarding directives:

# This file was updated by Duplicator Pro on 2023-07-11 12:30:13.
# See the original_files_ folder for the original source_site_htaccess file.
# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

And these are the lines I added at the end:

# BEGIN ElijahStreamsCustomCode

<IfModule ssl_module>
RewriteEngine On
RewriteCond %{HTTPS} !=on

Header always set Content-Security-Policy "upgrade-insecure-requests;"
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]
</IfModule>

# END ElijahStreamsCustomCode

HTACCESS MODIFICATIONS

• Removing the <IfModule> tags didn't fix the issue
• Removing the # Comments didn't fix the issue

I have tried clearing HSTS and browser cache, to no avail.

MY QUESTION

What is causing this and how can I solve it?

PLUGIN TESTS

• The issue did not go away with all plugins disabled.
• I completely deleted WordFence plugin including all tables and reinstalled multiple times. WordFence adds code to the .htaccess file, but the site works fine with the code except for the wells page.

SYSTEM SETUP:

• WAMP Manager: Local by Flywheel: 7.0.2+6395
• Windows 10 64-bit
• PHP: 8.1.9
• Web Server: Apache 2.4.43
• Database: MySQL 8.0.16
• SSL cert automatically generated and activated by Local

Related Posts:

• https://www.reddit.com/r/apache/comments/14wsjoc/apache_https_rules_work_on_live_staging_site_not/
• https://www.reddit.com/r/apache/comments/14w10sj/htaccess_file_set_to_forward_http_to_https_still/
• https://community.localwp.com/t/htaccess-file-work-on-live-server-but-500-server-error-on-local/38000

Answer 1

This is really an aside to your main issue, since this is not the cause, but...

And these are the lines I added at the end:

# BEGIN ElijahStreamsCustomCode

<IfModule ssl_module>
RewriteEngine On
RewriteCond %{HTTPS} !=on

Header always set Content-Security-Policy "upgrade-insecure-requests;"
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]
</IfModule>

# END ElijahStreamsCustomCode

This rule block should be added at the top^*1 of the .htaccess file, not at the end. If you put it at the end (after the WordPress code block) then the HTTP to HTTPS redirect is simply not going to be processed for all the "WordPress URLs" (including your problematic /wells/ URL). Only the homepage and static assets would be redirected.

^{(*1 Unless you have security directives that "block" particular requests, then this rule should come after those. Blocking directives should be first.)}

I notice that in one of your reddit threads you state that you moved this rule to the end in order to "fix the issue". Moving the rule to the end does not "fix" anything, it would simply mask the problem, since it's no longer being processed for the URL in question.

You have also erroneously split the rule in two. RewriteCond and RewriteRule are one rule and Header is a completely separate rule. As it happens, it still "works", due to the way Apache config files are processed. But it should be written like this:

# BEGIN ElijahStreamsCustomCode

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]

Header always set Content-Security-Policy "upgrade-insecure-requests;"

# END ElijahStreamsCustomCode

The <IfModule> wrapper is not required. Neither is the RewriteEngine On directive, that already occurs later in the config file as part of the core WordPress code block (it is actually the last instance of this directive that controls the file).

Note also that I reduced the RewriteRule pattern from ^(.*)$ to simply ^ since you are not making use of this in the rule (you are using the REQUEST_URI server variable instead).

Answer 2

SOLVED: I have been tracing these issues like whackamole for the past few days! Very frustrating, however I think what I discovered could help some.

I was having issues with SSL giving me a 500 server error on Local by Flywheel WAMP DEV server (my laptop) and then these issues popped up and it is difficult to know if they are the same issue, but they definitely seem related. But, here is what I discovered.

After I pushed from DEV to STAGING (Duplicator Pro plugin), WordFence security plugin apparently overwrote the version of .htaccess I had on DEV. Not sure if this is a result of how Duplicator works or how WordFence works.

The solution was to add the code back to the .htaccess file after the duplicator push was done and WordFence was installed and configured.