htacess https:// not redirecting to https://www

user_6029255 0
Viewed 39

Wordpress website. If you load http://example.com or https://example.com you get a security error on mobile. Redirect works fine on PC taking the user to https://www.example.com

What am I doing wrong?

RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]
Header always set Content-Security-Policy "upgrade-insecure-requests;"
server .htaccess redirect ssl-certificate ssl
1 Answers

A security error likely has nothing to do with your redirects or .htaccess. It probably means that your website is not serving a valid security certificate for requests for example.com. To be able to redirect from https://example.com to https://www.example.com you MUST secure that redirect with a security certificate for example.com.

The usual way do do this is to get a certificate with subject alternative names (SAN) for both example.com and www.example.com. Alternately the names could be example.com and *.example.com (wildcard certificate.)

As for why it is working on desktop for you, there are two possibilities:

  • You have a cached 301 redirect
  • You clicked through to accept the security certificate at some point
user_11453880
Related