Why would someone leave the door open when redirecting www to non-www using via the .htaccess. Please first make all traffic encrypted from http to https and THEN redirect from www to non-www. Here’s the trick:
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,NE,R=301]
Note: this only works in Apache. Cheers!