Add --adapt-scheme flag to rewrite HTTPS URLs to HTTP in server responses

[Copilot]

When a site is configured with HTTPS URLs in the database, wp server (which runs on plain HTTP) leaves HTTPS URLs in responses that bypass the existing option_home/option_siteurl filters — e.g. attachment URLs, site icon URLs, and hardcoded post content.

Changes

• src/Server_Command.php — Adds [--adapt-scheme] flag. When set, calls putenv('WPCLI_SERVER_ADAPT_SCHEME=1') before proc_open() so the child PHP process inherits it.

• router.php — When WPCLI_SERVER_ADAPT_SCHEME is set, registers an ob_start() callback that replaces https://<original-host> → http://<server-host> across the full response. Uses $GLOBALS['wpcli_server_original_url'] (already populated by the option_home filter) to identify the original host. No-ops gracefully when WordPress hasn't loaded (e.g. static PHP files).

• features/server.feature — New scenario: configures a WP install with HTTPS siteurl/home, injects a hardcoded HTTPS URL via an mu-plugin wp_head filter (bypassing all existing option filters), and asserts the response contains only http:// URLs.

Usage

# Site was configured with https://example.com; serve locally over HTTP with adapted links
wp server --adapt-scheme

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /usr/bin/php /usr/bin/php /home/REDACTED/work/server-command/server-command/vendor/wp-cli/wp-cli/bin/../php/boot-fs.php core install --url=REDACTED --title=WP CLI Site --admin_user=admin --admin_email=admin@example.com --admin_password=password1 --skip-email (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Server on http:// returns https:// links</issue_title>
<issue_description>If you have site on https and run php server on http the function get_site_icon_url return a link with https.

I think the problem here https://github.com/WordPress/WordPress/blob/master/wp-includes/general-template.php#L810, because WordPress should use here get_site_url() instead get_option( 'site_icon' ).

Maybe we can add filter on get_site_icon_url to fix it problem or we should fix it in WordPress?</issue_description>

<agent_instructions>Add an adapt-scheme flag</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@swissspidy Worth noting that `get_option( 'site_icon' )` just holds the ID of the site icon, not its URL. The actual URL is generated by `wp_get_attachment_image_url()` and then `wp_get_attachment_url()`, which uses the image URL stored in the attachment metadata in the database.

So the right filter in that case would probably be wp_get_attachment_url.</comment_new>
<comment_new>@schlessera
I'm not sure this can be easily solved. You still have all the links that are stored throughout post content fields that point to https://.

Maybe a better approach would be to add a flag --adapt-scheme that filters the actual output to replace all https:// links pointing to the local server with http:// links?</comment_new>

• Fixes Server on http:// returns https:// links #51

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/Server_Command.php	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR adds an --adapt-scheme flag to wp server to rewrite HTTPS links back to HTTP in served responses, addressing cases where HTTPS URLs come from sources that bypass existing home/siteurl option filters (e.g., attachment metadata, hardcoded content).

Changes:

• Add --adapt-scheme flag to wp server and pass enablement to the child PHP process via WPCLI_SERVER_ADAPT_SCHEME.
• Add an output-buffer callback in router.php that rewrites https://<original-host> to http://<current-host> across the response body.
• Add a Behat scenario asserting HTTPS URLs are rewritten to HTTP when the flag is enabled.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/Server_Command.php	Introduces --adapt-scheme and sets an env var before starting the PHP built-in server process.
router.php	Adds response-body rewriting via ob_start() when WPCLI_SERVER_ADAPT_SCHEME is present.
features/server.feature	Adds an integration scenario verifying rewritten URLs in output.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.