I want to include code in settings.php which would handle redirects to the www alias and also https.

Because it is for a distribution I would prefer not to have hard-coded URLs and I would also prefer not to be changing the .htaccess file so that core updates are easier.

I am using the code below, and I just want to be sure it doesn't have any security issues. Does it have any security issues, and I should therefore use different code?

// Redirect to www
  if (substr($_SERVER['HTTP_HOST'], 0, 4) !== 'www.') {
  header('Location: '.$protocol.'www.'.$_SERVER['HTTP_HOST'].'/'.$_SERVER['REQUEST_URI']);
// Redirect to HTTPS
  if($_SERVER["HTTPS"] != "on")
  header("Location: https://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]);
  • Welcome to Drupal Answers! Notice that security is not about using https://.
    – avpaderno
    Commented Jun 7, 2016 at 17:37
  • I take your point and thank you for the correction @kiamlaluno - my intent was to ask if the code is secure. Commented Jun 7, 2016 at 17:55

2 Answers 2


The caveat to the settings.php approach is 2 issues:

  1. Your redirect requires that Drupal be bootstrapped to work. If there's a resource that bypasses Drupal (e.g. any hosted files), you're not going to see the www redirect occur.
  2. It's arguably bad practice. settings.php is for Drupal settings; depending on your intent this might be considered a web server setting. A developer working on your project in a local environment might have trouble understanding where the redirect is coming from as standard Drupal configurations use the .htaccess file for this.

An alternative to prevent .htaccess overwriting would to be place the rewrite directive in an Apache configuration (e.g. vhost.conf if you're using virtual hosts) that defines your host.

  • 1. An interesting point that I hadn't considered, however the intended use case would make this an unlikely scenario. 2. Fair point although it is an internal distro and would not be used by external devs. Lastly I should do some reading up on Apache config. Thank you for the tips @Shawn Conn. Commented Jun 7, 2016 at 20:05

You can also choose to use the htaccess module that allows these options with some radio buttons. It comes with Drush integration for re-deploying the .htaccess file after a core update, and monitors and warns if the file has changed. You might find it interesting.

From the module page:

this module is dedicated to webmasters who don't want to manually modify htaccess every time during a version upgrade to use Drupal.

  • Might this approach be more efficient than using settings.php? Commented Jun 7, 2016 at 17:44
  • @MrPaulDriver Not sure, I suppose apache will process .htaccess before bootstrapping Drupal and loading the settings. So rather than loading Drupal 2 or 3 times, it will load .htaccess 2-3 times and then attempt to load Drupal. So my guess would be this is better. I might be wrong though. Commented Jun 7, 2016 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.