Both should work; one should be canonical.
WHY IT MATTERS
Search engines may treat them as two sites, splitting rankings Login cookies set on one hostname are not read on the other, causing login loops Analytics data is split
CHOOSING
It makes no practical difference which. Non-www is shorter and more common now. Pick one and apply it everywhere.
IMPLEMENTING IT
Set the application's site address to your chosen form. Add a single redirect from the other form, combined with the HTTPS redirect so there is one hop rather than two.
Use cPanel > Redirects with a permanent 301, or an .htaccess rule, but not both.
CERTIFICATES
AutoSSL covers both forms by default, so a visitor typing either reaches a valid certificate before being redirected. Without that, they see a warning first.
TESTING
Visit all four combinations in a private window: http and https, with and without www. Every one should arrive at your canonical form with a padlock and a single redirect.
