[1] If I have sudo on LAMP VMs (Ubuntu 16.04 Apache 2.4 php 7) running WordPress website, where do I force redirect HTTP → HTTPS?

  1. Virtual Hosts
  2. .htaccess
  3. wp-config.php
  4. functions.php
  5. iThemes Security Plugin
  6. Combination of the above
  7. All of the above

[2] Following on from the above question, is it then superior to replace URLs in the database (e.g. site_url, home_url) http://example.comhttps://example.com, or leave them as http://? For example, I have had to fix infinite redirection loops multiple times when migrating to a new server which is owing to my suboptimal configuration(s) no doubt, but that might be one argument to leave as http://.

I know using .htaccess directives is a performance compromise, but I'm weighing the practical aspects as well as performance. What are you actually using in practice?

2 Answers 2


@Tim's answer is correct but there is one more step.

As he said, do the HTTP to HTTPS redirects in the apache/virtual host config. And yes, you need to update the DB. However, just updating the settings isn't enough (might work but you'll end up with needless requests to HTTP still, which then return a redirect). WordPress stores all internal links as absolute URLs. I would therefore recommend using wp cli to rewrite all stored URLs to HTTPS.

wp search-replace http://www.example.com https://www.example.com --all-tables
  • 2
    One thing I have never understood is why WordPress couldn't simply use relative URLs like any other CMS. Commented Mar 4, 2018 at 11:34
  • 1
    @EsaJokinen: me neither. Total pain. Hence much use of wp cli replaces...
    – Adam
    Commented Mar 5, 2018 at 20:03
  1. Apache virtual hosts.
  2. Use the Wordpress settings to update the site URL.

Not the answer you're looking for? Browse other questions tagged .