Force SSL/https using .htaccess and mod_rewrite [closed]

Question

Closed. This question is not about programming or software development. It is not currently accepting answers.

This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.

Closed 4 months ago.

The community reviewed whether to reopen this question 4 months ago and left it closed:

Original close reason(s) were not resolved

Improve this question

How can I force to SSL/https using .htaccess and mod_rewrite page specific in PHP.

I found a mod_rewrite solution that works well for both proxied and unproxied servers. See the answer at stackoverflow.com/a/34065445 — raphinesse
– raphinesse, Commented May 3, 2016 at 13:54

UKB · Accepted Answer · 2014-05-13 16:12:18Z

467

For Apache, you can use mod_ssl to force SSL with the SSLRequireSSL Directive:

This directive forbids access unless HTTP over SSL (i.e. HTTPS) is enabled for the current connection. This is very handy inside the SSL-enabled virtual host or directories for defending against configuration errors that expose stuff that should be protected. When this directive is present all requests are denied which are not using SSL.

This will not do a redirect to https though. To redirect, try the following with mod_rewrite in your .htaccess file

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

or any of the various approaches given at

http://www.askapache.com/htaccess/http-https-rewriterule-redirect.html

You can also solve this from within PHP in case your provider has disabled .htaccess (which is unlikely since you asked for it, but anyway)

if (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on') {
    if(!headers_sent()) {
        header("Status: 301 Moved Permanently");
        header(sprintf(
            'Location: https://%s%s',
            $_SERVER['HTTP_HOST'],
            $_SERVER['REQUEST_URI']
        ));
        exit();
    }
}

edited May 13, 2014 at 16:12

UKB

1,2322 gold badges12 silver badges15 bronze badges

answered Dec 9, 2010 at 14:16

Gordon

318k76 gold badges548 silver badges566 bronze badges

Sign up to request clarification or add additional context in comments.

11 Comments

Michael J. Calkins Over a year ago

This is great in our situation because we currently have a mixture of http and https traffic. For our admin area we just popped in the .htaccess script while keeping the rest of the site http.

Czechnology Over a year ago

When I use the mod_rewrite method, I get sent to https but with a "The page isn't redirecting properly" error.

Czechnology Over a year ago

Followup: If you're having similar trouble, check your server and HTTP variables. If your server uses proxies, you might want to use %{HTTP:X-Forwarded-Proto} or %{HTTP:X-Real-Port} variables to check whether SSL is turned on.

raphinesse Over a year ago

If you experience redirect loops on servers running behind proxies (CloudFlare, Openshift), see this answer for a solution that works for that case too.

Sphinxxx Over a year ago

@GTodorov - Removing the space broke the rewriterule for me. From my (limited) knowledge of rewriterules, the syntax is RewriteRule <input-pattern> <output-url>. Thus, the space needs to be there, and the single ^ just says "match all input URLs".

|

Luke Stevenson · Accepted Answer · 2010-12-09 16:04:09Z

36

PHP Solution

Borrowing directly from Gordon's very comprehensive answer, I note that your question mentions being page-specific in forcing HTTPS/SSL connections.

function forceHTTPS(){
  $httpsURL = 'https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
  if( count( $_POST )>0 )
    die( 'Page should be accessed with HTTPS, but a POST Submission has been sent here. Adjust the form to point to '.$httpsURL );
  if( !isset( $_SERVER['HTTPS'] ) || $_SERVER['HTTPS']!=='on' ){
    if( !headers_sent() ){
      header( "Status: 301 Moved Permanently" );
      header( "Location: $httpsURL" );
      exit();
    }else{
      die( '<script type="javascript">document.location.href="'.$httpsURL.'";</script>' );
    }
  }
}

Then, as close to the top of these pages which you want to force to connect via PHP, you can require() a centralised file containing this (and any other) custom functions, and then simply run the forceHTTPS() function.

HTACCESS / mod_rewrite Solution

I have not implemented this kind of solution personally (I have tended to use the PHP solution, like the one above, for it's simplicity), but the following may be, at least, a good start.

RewriteEngine on

# Check for POST Submission
RewriteCond %{REQUEST_METHOD} !^POST$

# Forcing HTTPS
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{SERVER_PORT} 80
# Pages to Apply
RewriteCond %{REQUEST_URI} ^something_secure [OR]
RewriteCond %{REQUEST_URI} ^something_else_secure
RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

# Forcing HTTP
RewriteCond %{HTTPS} =on [OR]
RewriteCond %{SERVER_PORT} 443
# Pages to Apply
RewriteCond %{REQUEST_URI} ^something_public [OR]
RewriteCond %{REQUEST_URI} ^something_else_public
RewriteRule .* http://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

answered Dec 9, 2010 at 16:04

Luke Stevenson

10.3k2 gold badges28 silver badges41 bronze badges

6 Comments

depoulo Over a year ago

out of curiosity, why the RewriteCond %{REQUEST_METHOD} !^POST$ ?

Luke Stevenson Over a year ago

Because POST parameters aren't retained on a redirect. You can omit that line if you want to make sure that all POST submissions are secure (any unsecured POST submissions will be ignored).

StackOverflowNewbie Over a year ago

@Lucanos - How to write a RewriteCond that doesn't force a redirect to either http or https when POST? My .htaccess forces HTTPS on certain specific pages, and then forces HTTP on the rest. However, on the HTTPS pages, there are forms that submit to my web root. The form specifies the action url as HTTPS. However, since the web root isn't one of those pages that are specified to force HTTPS, my .htaccess then forces a redirect -- which means the POST variables are lost. How do I prevent redirects on POST?

Luke Stevenson Over a year ago

@StackOverflowNewbie: The line RewriteCond %{REQUEST_METHOD} !^POST$ should prevent POST submissions from being affected by these redirections.

TheStoryCoder Over a year ago

I like this PHP version. It is much better as it considers a POST and handles better if headers have already been sent.

|

Glorfindel · Accepted Answer · 2017-04-12 07:54:03Z

14

Mod-rewrite based solution :

Using the following code in htaccess automatically forwards all http requests to https.

RewriteEngine on

RewriteCond %{HTTPS}::%{HTTP_HOST} ^off::(?:www\.)?(.+)$
RewriteRule ^ https://www.%1%{REQUEST_URI} [NE,L,R]

This will redirect your non-www and www http requests to www version of https.

Another solution (Apache 2.4*)

RewriteEngine on

RewriteCond %{REQUEST_SCHEME}::%{HTTP_HOST} ^http::(?:www\.)?(.+)$
RewriteRule ^ https://www.%1%{REQUEST_URI} [NE,L,R]

This doesn't work on lower versions of apache as %{REQUEST_SCHEME} variable was added to mod-rewrite since 2.4.

edited Apr 12, 2017 at 7:54

Glorfindel

22.8k13 gold badges97 silver badges124 bronze badges

answered Feb 18, 2017 at 17:51

Amit Verma

41.3k21 gold badges97 silver badges117 bronze badges

Comments

Community · Accepted Answer · 2017-05-23 12:02:58Z

I'd just like to point out that Apache has the worst inheritance rules when using multiple .htaccess files across directory depths. Two key pitfalls:

Only the rules contained in the deepest .htaccess file will be performed by default. You must specify the RewriteOptions InheritDownBefore directive (or similar) to change this. (see question)
The pattern is applied to the file path relative to the subdirectory and not the upper directory containing the .htaccess file with the given rule. (see discussion)

This means the suggested global solution on the Apache Wiki does not work if you use any other .htaccess files in subdirectories. I wrote a modified version that does:

RewriteEngine On
# This will enable the Rewrite capabilities

RewriteOptions InheritDownBefore
# This prevents the rule from being overrided by .htaccess files in subdirectories.

RewriteCond %{HTTPS} !=on
# This checks to make sure the connection is not already HTTPS

RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [QSA,R,L]
# This rule will redirect users from their original location, to the same location but using HTTPS.
# i.e.  http://www.example.com/foo/ to https://www.example.com/foo/

Saurabh Mistry · Accepted Answer · 2018-07-20 12:02:51Z

5

Simple and Easy , just add following

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

answered Jul 20, 2018 at 12:02

Saurabh Mistry

13.8k5 gold badges60 silver badges78 bronze badges

2 Comments

ThN Over a year ago

This is pretty much what people all over the Internet telling you to do for forcing https. However, every time I do that, my whole website becomes FORBIDDEN or You have no permission to view. something like that... What am I doing wrong? I just want to know if you have any idea before I post a question on this.

Risteard Over a year ago

I had a similar problem and I had to apply the rules to the https.conf file. See my answer below.

Alexufo · Accepted Answer · 2017-01-11 15:18:52Z

0

This code works for me

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP:X-HTTPS} !1
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

answered Jan 11, 2017 at 15:18

Alexufo

1,8331 gold badge17 silver badges35 bronze badges

Comments

Mautoz · Accepted Answer · 2024-10-06 16:57:46Z

0

I wrote this into .htaccess file, it works

RewriteEngine on
SetEnvIf X-Forwarded-Proto https SERVER_PORT=443
SetEnvIf X-Forwarded-Proto https HTTPS=on
RewriteCond %{HTTP:HTTPS} !=on [NC]
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

answered Oct 6, 2024 at 16:57

Mautoz

791 silver badge3 bronze badges

Comments

ad08 · Accepted Answer · 2025-07-21 05:44:06Z

I tried below for force redirect , its works for all the three conditions

http://example.org => https://www.example.org,

http://www.example.org => https://www.example.org

https://example.org => https://www.example.org

RewriteEngine On

# Redirect http://example.org to https://www.example.org

RewriteCond %{HTTPS} off

RewriteCond %{HTTP_HOST} !^www\. [NC]

RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# Redirect http://www.example.org to https://www.example.org

RewriteCond %{HTTPS} off

RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# Redirect https://example.org to https://www.example.org

RewriteCond %{HTTPS} on

RewriteCond %{HTTP_HOST} !^www\. [NC]

RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

sephrrr · Accepted Answer · 2017-01-28 10:45:29Z

-1

Simple one :

RewriteEngine on
RewriteCond %{HTTP_HOST} ^(www\.example\.com)(:80)? [NC]
RewriteRule ^(.*) https://example.com/$1 [R=301,L]
order deny,allow

replace your url with example.com

answered Jan 28, 2017 at 10:45

sephrrr

831 silver badge15 bronze badges

1 Comment

Amir Savand Over a year ago

NO! The site URL needs to be dynamic.

Kashif Latif · Accepted Answer · 2017-09-13 09:44:04Z

-2

try this code, it will work for all version of URLs like

website.com
www.website.com
http://website.com

http://www.website.com

RewriteCond %{HTTPS} off
RewriteCond %{HTTPS_HOST} !^www.website.com$ [NC]
RewriteRule ^(.*)$ https://www.website.com/$1 [L,R=301]

edited Sep 13, 2017 at 9:44

answered Sep 13, 2017 at 7:36

Kashif Latif

6873 gold badges15 silver badges29 bronze badges

Collectives™ on Stack Overflow

Force SSL/https using .htaccess and mod_rewrite [closed]

10 Answers 10

11 Comments

PHP Solution

HTACCESS / mod_rewrite Solution

6 Comments

Comments

Comments

2 Comments

Comments

Comments

Comments

1 Comment

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

10 Answers 10

11 Comments

PHP Solution

HTACCESS / mod_rewrite Solution

6 Comments

Comments

Comments

2 Comments

Comments

Comments

Comments

1 Comment

Comments

Linked

Related