Fix HTTPS detection heuristic and unconditional URL rewriting (v1.4)

Author: bitcryptic-gw

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.4] - 2026-06-19
+### Fixed
+- HTTPS detection no longer uses a hostname-based heuristic (checking for a dot in `HTTP_HOST`). It now relies exclusively on a genuine `X-Forwarded-Proto: https` header, preventing false HTTPS detection on direct, non-proxied connections.
+- `home_url()` and `site_url()` filters are now gated on the detected HTTPS state, so URLs are only rewritten to `https://` when HTTPS has actually been detected. Previously the rewrite was unconditional, which forced HTTPS URLs even on plain-HTTP paths.
+
 ## [1.3] - 2025-09-11
 ### Added
 - Initial public release

README.md

@@ -4,8 +4,8 @@ A lightweight WordPress plugin that enforces HTTPS detection and correct REST AP
 
 ## Features
 
-- Forces `$_SERVER['HTTPS'] = 'on'` when proxy headers or domain heuristics indicate HTTPS
-- Rewrites `home_url()` and `site_url()` to always return `https://`
+- Forces `$_SERVER['HTTPS'] = 'on'` when a genuine `X-Forwarded-Proto: https` header is present
+- Rewrites `home_url()` and `site_url()` to `https://` when HTTPS has been detected (no longer unconditional)
 - Ensures Rank Math SEO plugin uses the correct REST API base
 - Compatible with Dockerized WordPress stacks and reverse proxy setups
 

proxy-aware-https-fix.php

@@ -3,46 +3,37 @@
 /**
  * Plugin Name: Proxy-Aware HTTPS Fix
  * Description: Enforces HTTPS detection and correct REST API resolution behind reverse proxies.
- * Version: 1.3
+ * Version: 1.4
  * Author: BitCryptic
  */
 
-if ( defined( 'WP_CLI' ) && WP_CLI ) {
-	return;
-}
+if (defined('WP_CLI') && WP_CLI) return;
 
-add_action(
-	'plugins_loaded',
-	function () {
-		$host  = $_SERVER['HTTP_HOST'] ?? '';
-		$proto = $_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '';
+add_action('plugins_loaded', function() {
+    $proto = $_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '';
 
-		if (
-		( ! isset( $_SERVER['HTTPS'] ) || $_SERVER['HTTPS'] !== 'on' ) &&
-		( $proto === 'https' || strpos( $host, '.' ) !== false )
-		) {
-			$_SERVER['HTTPS'] = 'on';
-		}
-	}
-);
+    if (
+        (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on') &&
+        $proto === 'https'
+    ) {
+        $_SERVER['HTTPS'] = 'on';
+    }
+});
 
-add_filter(
-	'home_url',
-	function ( $url ) {
-		return str_starts_with( $url, 'http:' ) ? 'https:' . substr( $url, 5 ) : $url;
-	}
-);
+add_filter('home_url', function($url) {
+    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
+        return str_starts_with($url, 'http:') ? 'https:' . substr($url, 5) : $url;
+    }
+    return $url;
+});
 
-add_filter(
-	'site_url',
-	function ( $url ) {
-		return str_starts_with( $url, 'http:' ) ? 'https:' . substr( $url, 5 ) : $url;
-	}
-);
+add_filter('site_url', function($url) {
+    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
+        return str_starts_with($url, 'http:') ? 'https:' . substr($url, 5) : $url;
+    }
+    return $url;
+});
 
-add_filter(
-	'rank_math/rest_api_url',
-	function () {
-		return get_site_url( null, '/wp-json/' );
-	}
-);
+add_filter('rank_math/rest_api_url', function() {
+    return get_site_url(null, '/wp-json/');
+});