13

I have ONE directory for my entire domain that I want to force https, which is "/docs". In the /docs folder, I have the following htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This is forcing https to everything in the /docs directory, which is what I want it to do. The problem I am having is trying to force REMOVE https back to http for all other areas of my site. In the root folder of the site (which is running wordpress), I have the following htaccess file:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !^/docs/?.*$
RewriteRule ^(.*)$ http://www.mydomain.com/$1 [R=301,L]

Unfortunately, this is not working. I can still access other areas of my site over https.

What do I need to change to get this to work correctly?

4 Answers 4

27

Since the accepted answer doesn't actually answer the question, I figured I'd post my solution to this. Add this to your .htaccess file to force HTTP instead of HTTPS:

# BEGIN Force HTTP
RewriteEngine On
RewriteCond %{SERVER_PORT} 443
RewriteRule ^(.*)$ http://yourdomain.com/$1 [R=301,L]
# END Force HTTP
6
  • 2
    Thanks rog for answering the question that was asked. ;) Commented Jan 13, 2017 at 15:52
  • 3
    This doesn't work, if the HTTPS version doesn't have a valid cert. (Because browsers' cert alerts always come BEFORE Apache rewrites.) Commented Feb 20, 2017 at 8:36
  • @TamásBolvári valid point, however the question mentions that they've got a valid cert in use.
    – rog
    Commented Mar 6, 2017 at 4:06
  • 1
    @RezaS While I agree with your assessment that everyone should use HTTPS, I am cognizant of the fact that sometimes uncommon edge cases require unorthodox solutions. I don't assume to know what is best for everyone, so I try to answer questions as they're asked. Judging by the votes this answer has received, it appears some people found this useful. This is the first time I've received a down-vote for correctly answering the question as it was asked.
    – rog
    Commented Oct 16, 2017 at 9:20
  • 1
    I tried to use this answer and it didn't work after I placed the lines after some others already in the .htaccess file, but carefully checking, the lines were doing some more tasks related to the URL so I changed the position of the new lines locating them at the beginning, and "Voila"! it worked.
    – Magcrider
    Commented Sep 20, 2019 at 14:51
1

Try the Force non-SSL plugin for wordpress.

1
  • Will that work if the directory to be SSL is outside the WordPress directory? Commented Sep 20, 2012 at 6:49
1

The "WordPress Force HTTP" plugin was the only thing that worked for me. It changes https to http for not just the front page like most of the answers out there, but also changes https to http for all sub-directories in your website.

https://en-au.wordpress.org/plugins/wp-force-http/

-18

Why do you need to revert back to http? If you have the proper SSL certificates you might as well keep your access secure. Unless you are concerned about the load on your system.

I know this is not answering the question, but I want to emphasize that the question is asking on how to do a bad practice, which shouldn't be done in the first place.

2
  • 1
    Load on system, some images and javascript will be mixed http/https, etc.
    – MultiDev
    Commented Apr 27, 2012 at 18:40
  • 1
    Use relative URIs to avoid problems with mixed security levels (//example.com/foo/bar.jpeg if you need to change host).
    – Quentin
    Commented Apr 27, 2012 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.