Rewrite HTTP URLs to use HTTPS

[westonruter]

Any self-referential URL that is served from the site—including URLs for links, images, videos, scripts, styles, etc.— should get re-written to use HTTP instead of HTTPS when the user has opted-in. See core ticket wp#28521:

• Force https connections (pretty much covered by #27954)
• Force local URLs within content to https
• Force local enqueued scripts and styles to https
• Force non-local enqueued scripts and styles to https
• Set the secure flag on all cookies

What we won't do:

• Force non-local URLs within content to https
• Force the https version of oEmbeds just yet - see #28507
• Send an HSTS header - see #28520

Additionally, pages should be served with the upgrade-insecure-requests content security policy so that if there are any URLs that leak through which didn't get rewritten that supporting browsers (~80%) will then do it instead.

[westonruter]

See 3-year-old core patch for what it does: https://core.trac.wordpress.org/attachment/ticket/28521/28521.diff

Note the proposed force_ssl() function. If no such FORCE_SSL constant is defined, it could then look to the options to find the opt-in.

[postphotos]

Hi @westonruter - I know there are a few working solutions that tackle this elsewhere already. For example, I've used Insecure Content Fixer in sites before during a transition to HTTPS:
Github: https://github.com/webaware/ssl-insecure-content-fixer
WP.org page: https://en-gb.wordpress.org/plugins/ssl-insecure-content-fixer

This may be helpful as we devise a solution here.

[westonruter]

From looking at the plugin directory, these seemed to me to be the most widely-adopted HTTPS-facilitating plugins:

• https://wordpress.org/plugins/really-simple-ssl/ (1+ million installs)
• https://wordpress.org/plugins/ssl-insecure-content-fixer/ (200k+ installs)
• https://wordpress.org/plugins/wordpress-https/ (100k+ installs)
• https://wordpress.org/plugins/https-redirection/ (100k+ installs)
• https://wordpress.org/plugins/wp-force-ssl/ (50k+ installs)
• https://wordpress.org/plugins/force-https-littlebizzy/ (50K+ installs)