Your site can be reached at four addresses: http://example.com, http://www.example.com, https://example.com and https://www.example.com. Search engines treat them as separate URLs, and visitors may see certificate warnings on the ones you forgot. Pick one canonical address and send the other three to it with a single 301 redirect.
Before you start
- Decide on www or non-www. Both are fine for SEO; consistency is what matters. If the site is established, keep whichever Google already shows.
- Both names must point to MdmHost: an A record for the bare domain and an A record or CNAME for
wwwin cPanel → Domains → Zone Editor. - Both names must be on the certificate. Check cPanel → Security → SSL/TLS Status; AutoSSL normally includes
wwwautomatically.
Why the certificate matters
A redirect from https://www.example.com to https://example.com only works after the browser has completed an HTTPS connection to www. If the certificate does not cover www, visitors see a warning before the redirect can happen. Fix coverage first, then redirect.
Redirect to non-www HTTPS
Add at the top of .htaccess in the document root (cPanel → Files → File Manager, hidden files shown), above any WordPress block:
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]Redirect to www HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://www.%1%{REQUEST_URI} [L,R=301]Each rule handles all variants in one hop, so there is no chain of HTTP → HTTPS → www.
Note: If you use one of these rules, switch off Force HTTPS Redirect in cPanel → Domains → Domains for that domain to avoid two layers of redirects.
Match WordPress
In Settings → General, set both addresses to exactly the canonical URL. WordPress also redirects to this host on its own, but the server rule is faster and covers images and files.
Static sites and builders
SitePad, Sitejet and plain HTML sites use the same .htaccess rules. Make sure the builder's publishing folder is the document root where you add the file, and that republishing does not overwrite your .htaccess.
Test all four variants
curl -sI http://example.com | grep -i location
curl -sI http://www.example.com | grep -i location
curl -sI https://www.example.com | grep -i locationEach should return a single 301 with Location pointing to the canonical HTTPS URL. The canonical URL itself returns 200.
Tell search engines
- Use a Domain property in Google Search Console, which covers all variants.
- Make sure your SEO plugin's canonical tags and sitemap use the canonical address.
Troubleshooting
- Too many redirects: Cloudflare is in Flexible SSL mode, or another rule redirects the opposite way.
- Certificate warning on www:
wwwmissing from DNS or the certificate; fix and run AutoSSL. - Subdomains redirect to the main site: the www-adding rule matched them; limit it with
RewriteCond %{HTTP_HOST} ^example\.com$ [NC].