Stop redirecting HTTPS to HTTP on WordPress

Why it matters

The HTTPS homepage sends visitors back to plain http, so the encrypted connection is thrown away and their traffic is exposed again. It usually means the application believes its address starts with http:// or a redirect rule points the wrong way.

The fix

1. In Settings, General, both WordPress Address (URL) and Site Address (URL) must start with https://. If the fields are greyed out, WP_HOME and WP_SITEURL are defined in wp-config.php; change them there.
2. If the site sits behind a proxy or CDN that terminates HTTPS (Cloudflare, a load balancer), WordPress sees http requests. Add the snippet below to wp-config.php above the line that says to stop editing, and only when that proxy is the only way in.
3. Check SSL or redirect plugins and .htaccess rules for redirects to http://, then clear any page cache.

// wp-config.php: trust the scheme reported by your HTTPS proxy or CDN.
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
	$_SERVER['HTTPS'] = 'on';
}

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Serve the site over HTTPS
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Redirect HTTP straight to HTTPS
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS