Hello!
I also recommend always using the HTTPS scheme. This is not only because it helps better protect your visitors’ privacy or hide your password from snoopers but also because your webserver can serve content using new protocols, such as HTTP/2, for a faster browsing experience.
WordPress already primarily handles HTTP-to-HTTPS scheme redirection. If you go to “WP Admin > Settings > General,” you should change http:// to https:// for both the WordPress Address and Site Address fields.
After adjusting the settings in WordPress (it is important that you do), you might find your site is still reachable via plain http://. This is not a big issue because search engines will start coercing potential visitors to the HTTPS version of your site. Still, if that’s the case, your hosting provider might have an option to redirect visitors to the HTTPS version of your site.
Alternatively, you can implement a custom .htaccess rule:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Or you could resort to using Cloudflare’s toggle, which is acceptable for most use-cases I can imagine.
I strongly advise against using WordPress plugins to manage your site’s scheme settings. They don’t do anything useful and only slow down your website. They’re only popular because their users haven’t been bestowed the knowledge I just shared with you. You’re welcome 🙂
-
This reply was modified 1 year, 8 months ago by
Sybre Waaijer. Reason: markup
Hi @cybr
Thank you so much for all this information! This is really helpful! I will take your advice not to use WordPress plugins to manage your site’s scheme settings. As you’ve probably noticed, I’m new to WordPress and everything related to it. So I’m struggling to understand how everything relates to everything else (not an easy task!)!
I have already changed http:// to https:// for both the WordPress address and the website address, and you are right, my hosting provider does offer an HTTPS option. Are these measures enough and does this mean that it is not necessary to configure Cloudflare’s switching feature or implement a custom .htaccess rule (sorry, I realise this may already be a little off topic)?
The important work is updating the WordPress Address and Site Address fields; I’m glad you took up that advice.
Now, if you access your website using http:// and get redirected to the https:// version, then the server-sided redirect also works, and there’s nothing else you need to do.
Have a lovely day 🙂