v5.7.2 - HTTPS Redirect Works for Pages But Fails for Posts

[bvallance]

Environment:
LOCALHOST -

• Apache v2.4.43a
• PHP v7.4.0
• WordPress v5.7.2
• Chrome v91

Issue:
Brand new installation of WordPress v5.7.2. The "WordPress Address (URL)" and "Site Address (URL)" protocol values are both set to "https." The Settings>General>Reading>"Your home page displays" is set to a static page. When the browser accesses the static home page, https is used, as expected. Editing https to http in the home page URL, then refreshing the browser, causes a redirect to https, also as expected.

The same thing DOESN'T happen when accessing posts. The "WordPress Address (URL)" and "Site Address (URL)" protocol values are both set to "https." The Settings>General>Reading>"Your home page displays" is set to "Your latest posts." When the browser accesses the site, the posts summary page is displayed using https, as expected. When the posts summary page URL is edited to change https to http and the browser is refreshed, the post summary page is displayed using http, not https.

It appears that automatic https redirection is enabled for pages BUT NOT FOR POSTS in WordPress v5.7.2 when the protocol values for both the "WordPress Address (URL)" and "Site Address (URL)" settings are set to "https."

Browsing data was cleared before every test was run to eliminate the effect of the browser cache on test results.

Is this a bug or is this intended behavior? This appears to be a potential security issue.

[bvallance]

After some additional testing, it appears that what is happening is that on pages that contain linked content (e.g., images), the links contain https as the protocol, not http. This forces an https redirect for the entire page because one or more linked content items contains the https protocol. I have confirmed that https redirection does not happen for pages that don't contain any linked content (e.g., text blocks, separators, etc.). BTW - The post I was testing in my original post doesn't contain any linked content.

Am I correct that WordPress v5.7.2 does NOT perform automatic http redirection unless the page or post contains linked content whose URL(s) contains https as the protocol?

[bvallance]

This isn't a bug in WordPress - it's "idiot operator error" - me. I can access any content in WordPress 5.7.2 using EITHER http or https. I think I had an issue with multiple .htaccess files that was causing what I believed to be automatic https redirection. Please disregard this ticket.