WordPress redirect all HTTPS to HTTP

6 comments

1. The problem here lies with the fact that before Apache or WordPress come in to play, the browser needs to establish a connection with the server over HTTPS by connecting, performing an SSL handshake, exchanging (and verifying) certificates, and only after all that is done, will the browser issue the HTTP request that tells the server what resources it is looking for.

   Because of that, no .htaccess or WordPress plugin is going to be able to redirect the user without them establishing a secure session.

   Of course if you install a self-signed certificate, the user is going to be presented with a warning before any of this happens. If you by chance (which doesn’t seem to be the cast) had been sending Strict Transport Security headers over https, then previous visitors’ browsers may not even allow them to connect over HTTP.

   If you want to redirect HTTPS traffic to HTTP, unfortunately you are going to have to acquire a valid certificate and redirect using .htaccess or some PHP code as you are.

   If you’re looking for certificates that are trusted by a majority of browsers without paying, you can get a free certificate from Let’s Encrypt.

   Bottom line, if you want to seamlessly redirect HTTPS traffic to HTTP without any warning messages, you need to install another SSL certificate from a trusted CA.

2. Here is an alternative solution you can use if you don’t want to edit .htaccess:

   add_action( 'template_redirect', 'nonhttps_template_redirect', 1 );
   
   function nonhttps_template_redirect() {
   
       if ( is_ssl() && !is_admin() ) {
   
           if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {
   
               wp_redirect( preg_replace( '|^https://|', 'http://', $_SERVER['REQUEST_URI'] ), 301 );
   
               exit();
   
           } else {
   
               wp_redirect( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], 301 );
   
               exit();
   
           }
   
       }
   
   }
   

   You can place this at the bottom of your theme functions.php

3. Expanding on @HigherCoding ‘s answer and @MrWhite ‘s comment, to get a PHP function to do this on a site where the https port exists but the ssl certification is invalid, expired or non-existent:

   function shapeSpace_check_https() { 
   if ((!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || $_SERVER['SERVER_PORT'] == 443) { 
       return true; 
   }
       return false;
   }
   
   
   function bhww_ssl_template_redirect() {
   if ( shapeSpace_check_https() ) {
       if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {    
           wp_redirect( preg_replace( '|^(https://)|', 'http://', $_SERVER['REQUEST_URI'] ), 301 );
           exit(); 
       } else {
           wp_redirect( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], 301 );
           exit();     
       }
   }   
   }
   
   add_action( 'template_redirect', 'bhww_ssl_template_redirect');
   

   This worked on my site in functions.php and was a combination of these two sources: Source 1 and Source 2.

   As @drew010 pointed out – this will still not prevent a scary prompt for users who type in https as part of your URL. But it will redirect them to http if they happen to click through the scary prompt, which is unlikely. It seems that getting an SSL certificate is likely the best option for this reason, for general security and for increased Google ranking now & in the future.

4. The htaccess way is simple especially if you don’t have access to admin area in WordPress.

   Just paste this below RewriteCond %{HTTPS} on

   RewriteRule (.*) HTTP://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
   

5. in addition to your lines please try to add these lines in wp-config.php

   define( 'WP_CACHE', false ); 
   define('WP_HOME','http://adwordslead.com');
   define('WP_SITEURL','http://adwordslead.com');
   define('FORCE_SSL_ADMIN', false);
   define( 'FORCE_SSL_LOGIN', false );
   

   hopefully, your error will resolve

6. This disables https completely

   
       <IfModule mod_rewrite.c> 
           RewriteEngine On
           RewriteCond %{HTTPS} off
       </IfModule>
   

   This leaves The HTTPS enabled and then uses server VARIABLES to redirect all pages to HTTP:

   
       <IfModule mod_rewrite.c>
           RewriteEngine On
           RewriteCond %{HTTPS} on
           RewriteRule .* http://%{HTTP_HOST}%{REQUEST_URI}
       </IfModule>
   

   Hope this helps you….

Comments are closed.