Moving Wordpress site to a secure server

[travelin cat]

We have a client that wants to convert their WordPress site to ssl. The certificate is already installed and is working as we tested changing the http to https in a browser and are shown the certificate and error messages that certain hard coded links need to be modified.

When we modified our company WordPress site, all of the redirects were in place without us having to do anything. Initially all pages showed HTTP/1.1 301 Moved Permanently (to https) and about a week later are all showing HTTP/1.1 200 without having to do any redirects ourself.

My question is this, do the redirections happen automatically on the server side, the WordPress side or somewhere else? I understand there will be ranking changes initially, but i don't want to leave out a step that may harm the client's rankings.

Thanks

[ergophobe]

I'm not sure I follow your question.

You're saying that you have some error messages saying pages are "mixed mode" (some secure, some not) and you want to know how to fix them?

If that's the case, you're probably pulling in resources in your theme using http - images, javascript, css, whatever.

An easy way to find all links that are causing this would be to just grep your file tree and database for [[^\s]+...] and see what shakes out.

But first go to a page that has these errors, view source and search on http:// - it might be one file on all pages

[travelin cat]

Sorry, that's not my question. I know I have to change the errors on the page after changing references to https

My question regards making redirects to ensure that this:

http://www.example.com/page
is recognized by the search engines as this:
https://www.example.com/page

The redirections appear to work automatically, and as I have very little experience with .htaccess or other redirection methods, I want to make sure I do not screw up. So I am just asking how the redirections work automagically....

[not2easy]

The easy fix is to first make sure that the settings file is accurate for the https URL format, then in the htaccess file add a line for Port 80 so that resources that are embedded as http will become https. That can be plugin css and/or images or resources. Check what is linked or visible in the html source/headers.

For this I use:

RewriteCond %{SERVER_PORT} ^80$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

which sould be positioned above the WP snippet in your htaccess:

# BEGIN WordPress
<IfModule mod_rewrite.c>
etc..

Edited after reading your response - just see what happens when you type in URLs from your old sitemaps. If everything is properly redirecting, great! If you want to be certain the redirects are 301, you would need to check headers with a tool for that such as FF extension Live HTTP Headers.

[ergophobe]

Got it.

%{SERVER_PORT} should do it, though on rare occasions, HTTP traffic could be on a different port (8080 and specialized traffic like CPanel will be on other ports, but that of course doesn't matter for SEO).

But to add a couple of other variables that test a bit more directly:

HTTPS - absolutely direct - tests whether it is a SSL/TLS connection and returns "off" or "on" with or without mod_ssl active.

REQUEST_SCHEME - tests the scheme in the request itself - if it returns http, you know you need to redirect.

RewriteCond %{HTTPS} off

or

RewriteCond %{REQUEST_SCHEME} http

Should work in addition to testing for port 80.

Also, the last time I did this back in April, you still couldn't "move" a site in Search Console between http and https, so you need to claim the site under the new URL and not panic every time you open up Seach Console and see all your ranking gone and no more traffic.

[not2easy]

The line for Port 80 is intended to handle existing resource links such as some old banner ad for example, or plugin resources such as images related to the plugin. I may have incorrectly assumed that the canonical rewrite was in place. If not, it should be before the line for Port 80 and go something like:

RewriteCond %{HTTP_HOST} !^(www\.example.com)?$ [OR]
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://www.example.com/$1 [R=301,L]

_{I would not consider using CPanel for settings, sorry.}

[ergophobe]

I wasn't suggesting using CPanel for settings (I don't actually use CPanel, so I'm not sure what settings it has that would be relevant here).

I was just saying that there are services like CPanel that are accessed via http that typically don't run on port 80.

But now that I think of it, this is irrelevant because though accessed via http(s), CPanel access is not going through Apache at all, so your Apache settings wouldn't make any difference. I think that would be true for anything that's not on port 80 unless you've specifically set up your server to use port 8080 or some such thing for web traffic.

[travelin cat]

Been out sick, thanks for your suggestions. Everything is working well. It's been a great learning experience.