WordPress

1. Settings → General: WordPress Address (URL) and Site Address (URL) must be exactly the final address, https:// and with or without www the same way the server redirects. A mismatch here causes an extra hop on every page.
2. Redirect plugins. In the Redirection plugin (Tools → Redirection), or in Yoast SEO Premium or Rank Math redirects, look for chains: if /old points to /new and /new points to /newest, change /old to point at /newest directly.
3. HTTPS plugins. If Really Simple SSL redirects to https and your host does as well, keep one. The plugin's redirect runs only after PHP starts, so the server's rule is the faster one.
4. Language plugins. If / redirects to /en/, WPML and Polylang can serve the default language without a language folder, or stop redirecting by browser language. That removes the hop for the homepage.
5. Permalinks. Use links in menus and content in the same form as Settings → Permalinks (with or without the trailing slash), so WordPress does not redirect them.

Clear the page cache afterwards (WP Rocket, LiteSpeed Cache, your host's cache).

cPanel

cPanel has two separate switches that are easy to stack: Domains → Domains → Force HTTPS Redirect and a www rule in Domains → Redirects. Together they make http://www take two hops.

Turn both off and use a single rule in .htaccess instead:

1. Open Files → File Manager, go to public_html, and in Settings tick Show Hidden Files (dotfiles).
2. Edit .htaccess and put the block from the Apache and LiteSpeed tab at the very top, before the # BEGIN WordPress section if there is one.
3. Test with the curl loop above.

Plesk

1. Websites & Domains → example.com → Hosting & DNS → Hosting: set Preferred domain to the form you want (with or without www), and turn on the Permanent SEO-safe 301 redirect from HTTP to HTTPS.
2. Remove any extra www or https rules you added to .htaccess or to Apache & nginx Settings for the same purpose.
3. Test all four variants with the curl loop above. If http://www still takes two hops, turn off the Plesk switches and use one rule instead (nginx or Apache tab).

nginx

The usual mistake is a port 80 block that keeps the host (https://$host$request_uri), so http://www goes to https://www first. Name the final host directly. On Debian and Ubuntu the site is in /etc/nginx/sites-available/example.com, on Rocky, Alma and CentOS in /etc/nginx/conf.d/example.com.conf:

# Every http request, with or without www: one hop to the final address.
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

# https://www: one hop as well.
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name www.example.com;
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    return 301 https://example.com$request_uri;
}

Certbot adds if ($host = www.example.com) { return 301 https://$host$request_uri; } blocks; those keep www and create the extra hop. Replace them with the blocks above.

Test and apply:

sudo nginx -t && sudo systemctl reload nginx

Apache and LiteSpeed

One rule for both http and www, in .htaccess at the top or in the virtual host:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [L,R=301]

Remove older rules that do only one of the two, otherwise they still run first. If you prefer www, use RewriteCond %{HTTP_HOST} !^www\. [NC] and https://www.example.com instead.

Warning: Behind Cloudflare or another proxy, %{HTTPS} is off even for https visitors, and this rule loops. Use RewriteCond %{HTTP:X-Forwarded-Proto} !https instead of the first condition, or do the redirect at Cloudflare (Cloudflare tab).

On your own server, test and reload (httpd instead of apache2 on Rocky, Alma and CentOS):

sudo apachectl configtest && sudo systemctl reload apache2

Cloudflare

Always Use HTTPS (SSL/TLS → Edge Certificates) sends http://www to https://www; a separate www redirect then adds a second hop. Make one redirect rule that catches both:

1. Go to Rules → Redirect Rules and Create rule.

2. Custom filter expression, then Edit expression:

   (http.host eq "www.example.com") or (not ssl)
   

3. URL redirect: type Dynamic, expression concat("https://example.com", http.request.uri.path), status 301, tick Preserve query string, and Deploy.

The www hostname needs a proxied DNS record (orange cloud) for the rule to run. Then check that the origin does not redirect again: if WordPress or the server still sends visitors to www, the two loop. The edge and the origin must agree on one final address.

Node.js and Next.js

Next.js redirects /about/ to /about (308) by default, or the other way round with trailingSlash: true. Use the same form in your links. For www, a single rule in next.config.js:

module.exports = {
    async redirects() {
        return [
            {
                source: '/:path*',
                has: [{ type: 'host', value: 'www.example.com' }],
                destination: 'https://example.com/:path*',
                permanent: true,
            },
        ];
    },
};

On Vercel or Netlify, set the redirect between www and the bare domain in the project's domain settings instead, and keep only one of the two. If nginx sits in front of the app, put the redirect there (nginx tab) and not in both places.