How make WP multisite create sites in https

Are you running subdomain or subdirectory multisite?

What type of SSL did you set up on this network? Single site or wildcard subdomains?

Have you made any edits to your .htaccess for implementing the SSL, and if so what are they?

If you go into Network Admin–Sites–edit a subsite, on the Settings tab, are the Siteurl and Home set to HTTPS? And if not, does making them so change your issue?

Jan, would this search & replace also work if I just exported the db, opened the .sql file as a text file and replaced all “http:” with “https:”, then import that new file into a new db, then switch the db creds in wp-config.php to the new db? (I was going to overwrite the orig db, but this would make it really easy to switch right back if it doesn’t work.)

And more importantly, will this make it so that all NEW subsites created are https — which was webtechIMT’s question in the first place? 🙂

Can everyone verify for me that they have https set for siteurl & home in main site settings and are still getting new http subsites? That’s my understanding of the original post above. I’m doing a little more checking, and more knowledgeable minds seem to think having those settings in the main site should carry over to subsites.

It is doable with a plugin but I am pretty sure that WordPress should pick up the scheme correctly. I’m not sure why it didn’t.

Try this plugin by copying the file into the mu-plugins directory.

/*
Plugin Name: Make new sites in the network with https URLs
Description: Force new sites in a multisite network to use HTTPS as the scheme.
Plugin Author: Jan Dembowski
*/

add_action( 'wpmu_new_blog', 'mh_new_site_http', 10, 6 );

function mh_new_site_http( $blog_id, $user_id, $domain, $path, $site_id, $meta ) {

        switch_to_blog( $blog_id );

        $mh_old_home_url = trailingslashit( esc_url( get_option( 'home' ) ) );
        $mh_old_site_url = trailingslashit( esc_url( get_option( 'siteurl' ) ) );

        $mh_new_home_url = preg_replace( '/^http:/' , 'https:' , $mh_old_home_url );
        $mh_new_site_url = preg_replace( '/^http:/' , 'https:' , $mh_old_site_url );

        update_option( 'home', $mh_new_home_url );
        update_option( 'siteurl', $mh_new_site_url );

        restore_current_blog();

}

If anything goes wrong then via your file management tools your host provided you with delete the new plugin file.

The gist of that is at this link and might be easier to read or copy.

https://gist.github.com/jdembowski/f223e46741a7be84bec1

When a new blog is added into a network, if the siteurl and home options are http:// then this will replace that to https:// instead. Except for when a blog is added to your WordPress network, this plugin will not be used.

I tested with Microsoft Edge as the browser because Chrome would switch to https no matter how much harsh language I used.

For my test the whole network was http only and my first site was and remains http. I copied the plugin into my mu-plugins directory and created new sites.

The new sites have an https URL for their siteurls and home options (the old sites are untouched). I then uploaded via the media library in the new site and that generated media URLs with https.

I did the same tests with the original site using http (I logged out, cleared my cookies and logged into the old http site). The media for that http only site was http and not https as expected.

Thanks. 😉

I don’t think this should be added to core. It doesn’t perform any checks (though I have an idea about that, to check if the right vhost replied and check if the X.509 cert is valid before changing the http: to https:).

When you look at the source code for install_blog( $blog_id, $blog_title = '' ) you see that WordPress tries to figure out the scheme.

https://core.trac.wordpress.org/browser/tags/4.4.2/src/wp-includes/ms-functions.php#L1347

If it sees https: then you should get that site URL. On my installation it doesn’t do that and I’m pretty sure it’s because I messed up somewhere.

To further complicate things, some browsers make me want to throw heavy objects at it. My Chrome browser sees a site and decides to switch to https regardless if I want it to or if there’s even a site there that accepts https. That’s why I had to test with Microsoft Edge as my browser.

If I can figure out how to test (I want to mess with send_headers() and the WP HTTP API) I’ll update the gist so that the site URL and home only get updated if WordPress can figure out if the site has a valid cert and is setup to reply.