Rewrite requests for non-HTTPs or naked domain variations to the https://www scheme with only one 301 redirect. The ruleset includes checks to ensure we are in a production environment and that Let's Encrypt requests can pass through unmodified.

.htaccess

# ----------------------------------------------------------------------
# If a URL is requested over an insecure connection or if the URL request
# contains the naked domain variation, redirect the request to the 
# https://www scheme.
# N.B there's nothing wrong with using naked domains, this is a stystic choice
# Adapted from: https://wp-mix.com/htaccess-redirect-http-to-https/
# ----------------------------------------------------------------------
<IfModule mod_rewrite.c>
 	# Check whether the request was made over an insecure protocol
  # N.B. CloudFlare & other reverse proxies don't always set https to on, so check HTTP:X-Forwarded-Proto too:
	RewriteCond %{HTTP_HOST} !\.test$
  RewriteCond %{HTTP:X-Forwarded-Proto} !https [OR]
	RewriteCond %{HTTPS} off [OR]
	# Check that we're not on staging and there is no 'www' subdomain prefix:
	RewriteCond %{HTTP_HOST} !^(staging|www)\.
	# Ignore Let's Encrypt certificate renewal checks:
	RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
  # If all conditions above match, rewrite to our secure www canonical domain:
	RewriteRule (.*) https://www.yourdomain.co.uk/$1 [R=301,L]
</IfModule>