Wordpress (WooCommerce?) forces https (when it shouldn't)

Question

I\'m experiencing a strange issue on a WooCommerce installation my company has taken over. It\'s not us who built it and unfortunately it\'s pretty crappy built so I\'m not so s

Answer 1

Kirby is right.

I did a quick fix modifying the Wordpress core function is_ssl().

I return false at the beginning of the function because some of my websites do not have SSL.

It's not recommended modify the core of Wordpress because of the updates, but I can control that.

Answer 2

http://develop.woothemes.com/woocommerce/2015/07/woocommerce-2-3-13-security-and-maintenance-release/

Updating Woocommerce to 2.3.13 fixed it for me

Answer 3

@Zertuk's solution is correct: upgrading to the latest WooCommerce should fix the issue because of the change that @Zertuk has linked.

To give more detail: Chrome has implemented the Upgrade Insecure Requests specification from the World Wide Web Consortium (W3C). Section 3.2.1 of that specification is The HTTPS HTTP Request Header Field which states

3.2.1. The HTTPS HTTP Request Header Field

The HTTPS HTTP request header field sends a signal to the server expressing the client’s preference for an encrypted and authenticated response, and that it can successfully handle the upgrade-insecure-requests directive in order to make that preference as seamless as possible to provide.

This preference is represented by the following ANBF:

"HTTPS:" *WSP "1" *WSP

WooCommerce's is_ssl() function before version 2.3.13 was incorrectly rewriting all the URLs in the response if the HTTPS: 1 header was set.

Upgrading to the latest version of WooCommerce (currently 2.3.13) fixes the bug.

Answer 4

I fixed this issue by turning off the Force SSL setting within WooCommerce Settings, and then explicitly setting these 3 WooCommerce pages to use SSL via the checkbox provided as part of this plugin (on the Edit Page screen).

The pages that needing SSL according to WooCommerce are:
1. Checkout
2. Checkout -> Pay
3. My Account

and also try,

<?php 
if (is_ssl()) {
 //action to take for page using SSL
}
?>

Returns true if the page is using SSL (checks if HTTPS or on Port 443).