I'm trying to redirect all insecure HTTP requests on my site (e.g. http://www.example.com) to HTTPS (https://www.example.com). I'm using PHP btw. Can I do this in .htaccess?
Join Stack Overflow to learn, share knowledge, and build your career.
|
Update: Although this answer has been accepted a few years ago, note that its approach is now recommended against by the Apache documentation. Use a
|
|||||||||||||||||||||
|
|
The Apache docs recommend against using a rewrite:
This snippet should go into main server configuration file, not into This article might have come up only after the question was asked and answered, but seems to be the current way to go. |
|||||||||||||||||||||
|
|
I'd recommend with 301 redirect:
|
|||||||||||||||||||||
|
|
As I was saying in this question, I'd suggest you avoid redirecting all HTTP requests to their HTTPS equivalent blindly, as it may cause you a false impression of security. Instead, you should probably redirect the "root" of your HTTP site to the root of your HTTPS site and link from there, only to HTTPS. The problem is that if some link or form on the HTTPS site makes the client send a request to the HTTP site, its content will be visible, before the redirection. For example, if one of your pages served over HTTPS has a form that says Of course, the mistake of providing the links that should be to the HTTPS site but that end up being for the HTTP site may cause problems as soon as you get something listening on the HTTP port on the same IP address as your HTTPS site. However, I think keeping the two sites as a "mirror" only increases the chances of making mistakes, as you may tend to make the assumption that it will auto-correct itself by redirecting the user to HTTPS, whereas it's often too late. (There were similar discussions in this question.) |
|||||||||||||||||||||
|
|
I found out that the best way for https and www on domain is
|
|||||
|
|
I like this method of redirecting from http to https. Because I don't need to edit it for each site.
|
|||
|
|
|
This is the html redirect approach it works but not the best.
PHP approach
.htaccess approch
copied from: www.letuslook.org |
|||||
|
|
Using the following code in your .htaccess file automatically redirects visitors to the HTTPS version of your site:
If you have an existing .htaccess file: Do not duplicate RewriteEngine On. Make sure the lines beginning RewriteCond and RewriteRule immediately follow the already-existing RewriteEngine On. |
||||
|
|
|
Add the following code to the .htaccess file:
Where [your domain name] is your website's domain name. You can also redirect specific folders off of your domain name by replacing the last line of the code above with:
|
|||
|
|
|
This is the proper method of redirecting HTTP to HTTPS using .htaccess according to GoDaddy.com. The first line of code is self-explanatory. The second line of code checks to see if HTTPS is off, and if so it redirects HTTP to HTTPS by running the third line of code, otherwise the third line of code is ignored.
https://www.godaddy.com/help/redirect-http-to-https-automatically-8828 |
||||
|
|
|
The best solution depends on your requirements. This is a summary of previously posted answers with some context added. If you work with the Apache web server and can change its configuration, follow the Apache documentation:
But you also asked if you can do it in a
If everything is working fine and you want browsers to remember this redirect, you can declare it as permanent by changing the last line to:
But be careful if you may change your mind on this redirect. Browsers remember it for a very long time and won't check if it changed. You may not need the first line If you look for a PHP solution, look at the $_SERVER array and the header function:
|
|||
|
|
|
Do everything that is explained above for redirection. Just add "HTTP Strict Transport Security" to your header. This will avoid man in the middle attack.
https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security |
|||
|
|
|
Through .htaccess This will help.
Also, Refer this for More Detail. How To Redirect Http To Https? |
|||||
|
|
To redirect all
If mod-rewrite isn't enabled and you are on apache 2.4, you can also use a Apache 2.4.
|
|||||
|
|
Unless you need mod_rewrite for other things, using Apache core IF directive is cleaner & faster:
You can add more conditions to the IF directive, such as ensure a single canonical domain without the www prefix:
There's a lot of familiarity inertia in using mod_rewrite for everything, but see if this works for you. More info: https://httpd.apache.org/docs/2.4/mod/core.html#if To see it in action (try without www. or https://, or with .net instead of .com): https://nohodental.com/ (a site I'm working on). |
|||
|
|
|
If you are using Apache, mod_rewrite is the easiest solution, and has a lot of documentation online how to do that. For example: http://www.askapache.com/htaccess/http-https-rewriterule-redirect.html |
|||
|
|
|
A different edge to this problem is when a Load Balancer comes into play. The situation is as follows: - Traffic from browser to Load Balancer, and back, is (should be) HTTPS - Traffic between Load Balancer and actual WebServer is HTTP. So, all server request variables in PHP or Apache show that the connection is just HTTP. And the HTTP and HTTPS directories on the Server are the same. The RewriteCondition in the approved answer does not work. It gives either a loop or it just doesn't work. Question is: How to get this working on a Load Balancer. (Or is the Load Balancer configured wrong. Which is what I'm hoping for because then I can move the problem over to the WebHosting company :-) ) |
|||||
|
|
If you are in a situation where your cannot access the apache config directly for your site, which many hosted platforms are still restricted in this fashion, then I would actually recommend a two-step approach. The reason why Apache themselves document that you should use their configuration options first and foremost over the mod_rewrite for HTTP to HTTPS. First, as mentioned above, you would setup your .htaccess mod_rewrite rule(s):
Then, in your PHP file(s) (you need to do this where ever it would be appropriate for your situation, some sites will funnel all requests through a single PHP file, others serve various pages depending on their needs and the request being made):
The above needs to run BEFORE any code that could potentially expose secure data in an unsecured environment. Thus your site uses automatic redirection via HTACCESS and mod_rewrite, while your script(s) ensure no output is provided when not accessed through HTTPS. I guess most people don't think like this, and thus Apache recommends that you don't use this method where possible. However, it just takes an extra check on the development end to ensure your user's data is secure. Hopefully this helps someone else who might have to look into using non-recommended methods due to restrictions on our hosting services end. |
|||
|
|
protected by starkeen Jun 9 '16 at 2:27
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?
httpd, not with PHP. – drudge Nov 3 '10 at 0:24http://– drudge Nov 3 '10 at 0:54