You want to force any URL that doesn't include either:
- HTTPS
- www subdomain
to be redirected to the corresponding URL including both.
The following directives in the .htaccess file worked for me for a simple static site:
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^domain.com$ [NC]
RewriteRule ^(.*)$ https://www.domain.com/$1 [R=301,L]
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
There must be a way to make the first condition generic and avoid hardcoding domain.com, I just didn't investigate it, maybe you already know how & can comment below ;-)