I maintain a retail store's eCommerce website, provided by a 3rd party. The HTTPS links do not load ('ERR_CONNECTION_TIMED_OUT') unless you put in the WWW before the doman name. The HTTP links forward to their respective www counterparts. This 3rd party has explained that HTTPS links would need to be forwarded to the www URLs as well but "Webforwards do not forward https." I am left with a sense that this will not be followed up on. Practically speaking, I don't think we will have any shoppers manually going in and typing https://store.com and encountering this issue. However, it doesn't seem to be good practice. I checked google, yahoo, bing, shopify, and bankofamerica all forward you to their www if you do just https://domain.com. What makes this not commonplace? It looks like Amazon forwards you to their standard http if not on a need-to-be-secure page.

Is there a security hole that could arise as a result of forwarding https://example.com requests to https://www.example.com? Why would anyone want to have an error when you could have it forward to somewhere?

1 Answer 1


If non-www links don't work it will also not work if you try to redirect such a link to another link, because it first needs to access the first link before it can get a redirect from there to the second link. And while it is hard to get any useful data from your error description I would recommend, that you check the problem yourself: a common problem is that the certificate for the site is for www.example.com and does not include example.com, so that latter will fail with an SSL error. In this case you would need to get a better certificate, redirecting will not work.

But, if you would achieve the forwarding (which I don't believe you can for the reasons above) it will not be a security risk, as long as the source of the redirect and the target of the redirect are both under the same control. E.g it will be a risk if you redirect it to a 3rd party side, because you don't have any control what the 3rd party side is doing.

  • Please re-read the question as I have updated it to be more thurough Commented Jun 21, 2014 at 6:50
  • @salt: I hope this answers your question regarding the security risk. But again, if the non-www page will not load you will not be able to do a redirect from there to the www page. Commented Jun 21, 2014 at 6:56
  • The non-secure non-www links forward to their respective www links. It seems to be just the https. Commented Jun 21, 2014 at 7:04
  • @salt: Like I said, check the specific error you get when trying to access the secure non-www link and if its a certificate problem you need a certificate with the non-www name in it. Commented Jun 21, 2014 at 7:43
  • It specifically times out. Always Commented Jun 21, 2014 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.