# Local Environments Should Mirror Production Protocol ## Claim A local development environment earns its keep by matching production's protocol and URL shape, so HTTPS and real-looking domains belong locally, not only in production. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds for web apps where HTTPS-only behavior (secure cookies, mixed-content rules, HSTS, service workers) affects functionality — mismatched protocol locally hides those bugs until deploy. - Breaks when local parity costs more setup friction than the bugs it actually prevents — a project with no HTTPS-dependent behavior gains little from the extra cert/domain setup. - Specific to protocol/URL-shape parity here; doesn't claim every dimension of local/production parity (data volume, server config, third-party services) matters equally. ## Evidence WordPress Studio frames its local HTTPS option around exactly this rationale: it lets developers "create sites with secure connections that more closely resemble production environments." The feature comes with real constraints that reinforce it's meant to be used, not just offered — custom domains must end in `.local` and be unique across a developer's Studio sites to avoid routing collisions. ## Links - [[3. Resources/Permanent Notes/Pick a Local WordPress Environment by Use Case Not Vendor Label]] — because applies-in; protocol parity is one more dimension (alongside DB access and live-site import) that determines whether a given local tool fits production-facing work. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — because applies-in; HTTPS/TLS parity between environments is a hosting-stack security practice, not just a WordPress Studio feature. - [[3. Resources/Permanent Notes/Environment Fidelity Not Model Quality Bounds What an Embedded Agent Can Repair]] — sibling claim in the same fidelity family: this note is about protocol/URL-shape parity, that note is about data-engine parity, and both name gaps between a local sandbox and production that surface only under specific conditions ## Tests / falsifiers - Find a documented case where an HTTPS-only bug (mixed content, secure-cookie failure) reached production because local dev ran on plain HTTP — would support the claim with a concrete cost example. - Find a project where enabling local HTTPS added meaningful setup friction (cert trust issues, `.local` domain collisions) without catching any real bug — would sharpen the "breaks when" boundary. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Literature Notes/Custom Domains and HTTPS Support in WordPress Studio]] — states the production-parity rationale for local HTTPS directly.