Enforce HTTPS for WP on Pantheon.io

wp-config-secure.php

<?php

// ...

/** A couple extra tweaks to help things run well on Pantheon. **/
if (isset($_SERVER['HTTP_HOST'])) {
    // HTTPS is now the default scheme.
    $scheme = 'https';
    $base_url = $scheme . '://' . $_SERVER['HTTP_HOST'];
    define('WP_HOME', $base_url);
    define('WP_SITEURL', $base_url);

    // Enforce HTTPS.
    if (!isset($_SERVER['HTTP_USER_AGENT_HTTPS']) || $_SERVER['HTTP_USER_AGENT_HTTPS'] != 'ON') {
      header('HTTP/1.0 301 Moved Permanently');
      header('Location: ' . $base_url . $_SERVER['REQUEST_URI']);
      exit();
    }
}

// ...

wp-config-standard.php

<?php

// ...

/** A couple extra tweaks to help things run well on Pantheon. **/
if (isset($_SERVER['HTTP_HOST'])) {
    // HTTP is still the default scheme for now. 
    $scheme = 'http';
    // If we have detected that the end use is HTTPS, make sure we pass that
    // through here, so <img> tags and the like don't generate mixed-mode
    // content warnings.
    if (isset($_SERVER['HTTP_USER_AGENT_HTTPS']) && $_SERVER['HTTP_USER_AGENT_HTTPS'] == 'ON') {
        $scheme = 'https';
    }
    define('WP_HOME', $scheme . '://' . $_SERVER['HTTP_HOST']);
    define('WP_SITEURL', $scheme . '://' . $_SERVER['HTTP_HOST']);
} 

// ...

wp-config.diff

diff --git a/wp-config.php b/wp-config.php
index 4639ada8..36786193 100755
--- a/wp-config.php
+++ b/wp-config.php
@@ -67,16 +67,18 @@ else:
 
     /** A couple extra tweaks to help things run well on Pantheon. **/
     if (isset($_SERVER['HTTP_HOST'])) {
-        // HTTP is still the default scheme for now. 
-        $scheme = 'http';
-        // If we have detected that the end use is HTTPS, make sure we pass that
-        // through here, so <img> tags and the like don't generate mixed-mode
-        // content warnings.
-        if (isset($_SERVER['HTTP_USER_AGENT_HTTPS']) && $_SERVER['HTTP_USER_AGENT_HTTPS'] == 'ON') {
-            $scheme = 'https';
+        // HTTPS is now the default scheme.
+        $scheme = 'https';
+        $base_url = $scheme . '://' . $_SERVER['HTTP_HOST'];
+        define('WP_HOME', $base_url);
+        define('WP_SITEURL', $base_url);
+
+        // Enforce HTTPS.
+        if (!isset($_SERVER['HTTP_USER_AGENT_HTTPS']) || $_SERVER['HTTP_USER_AGENT_HTTPS'] != 'ON') {
+          header('HTTP/1.0 301 Moved Permanently');
+          header('Location: ' . $base_url . $_SERVER['REQUEST_URI']);
+          exit();
         }
-        define('WP_HOME', $scheme . '://' . $_SERVER['HTTP_HOST']);
-        define('WP_SITEURL', $scheme . '://' . $_SERVER['HTTP_HOST']);
     }
     // Don't show deprecations; useful under PHP 5.5
     error_reporting(E_ALL ^ E_DEPRECATED);