Framework for detecting HTTPS support and migrating sites from HTTP to HTTPS.

Since: 5.7.0
Source: wp-includes/https-detection.php, wp-includes/https-migration.php

Components

Detection Flow

wp_is_using_https()
    ├── wp_is_home_url_using_https()
    │       └── Check if home_url() uses HTTPS scheme
    └── wp_is_site_url_using_https()
            └── Check if site_url() uses HTTPS scheme

wp_is_https_supported()
    └── wp_get_https_detection_errors()
            ├── apply_filters('pre_wp_get_https_detection_errors')
            ├── wp_remote_request() with sslverify=true
            ├── Fallback: wp_remote_request() with sslverify=false
            ├── Check response code (200)
            └── wp_is_local_html_output() verification

Migration Flow

wp_update_urls_to_https()
    ├── Get current 'home' and 'siteurl' options
    ├── Replace http:// with https://
    ├── update_option() for both
    ├── Verify wp_is_using_https()
    └── Revert on failure

update_option('home')
    └── wp_update_https_migration_required()
            ├── Check if new URL is HTTPS version of old
            ├── Set 'https_migration_required' option
            └── Fresh sites skip migration

wp_replace_insecure_home_url()
    └── wp_should_replace_insecure_home_url()
            ├── Check wp_is_using_https()
            ├── Check 'https_migration_required' option
            ├── Verify home/site domains match
            └── apply_filters('wp_should_replace_insecure_home_url')

Key Options

Content Replacement

When https_migration_required is true and the site uses HTTPS, WordPress automatically replaces HTTP URLs in content:

• Replaced: http://example.com → https://example.com
• Escaped URLs: http://example.com → https://example.com

Applied via filters on the_content, the_excerpt, etc.

Error Detection

The detection system identifies these error types: