How to redirect HTTP to HTTPS with .htaccess

Security··· 518 views· 3 min read

This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address.

Before you start

Make sure SSL is already active on the domain (it is, by default, through AutoSSL - see what an SSL certificate is) before adding this redirect, or visitors will be sent to a page that doesn't load.

Adding the redirect

1 In cPanel, open File Manager and go into public_html (or the site's folder, if it isn't the main domain).
2 Open the .htaccess file for editing - if there isn't one yet, create it. Make sure hidden files are visible, since it starts with a dot.
3 Add these lines at the very top of the file, above anything already there (such as WordPress's own rules): 
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
4 Save the file and test by visiting the http:// version of your site - it should land on https:// automatically.
Using Cloudflare? If your domain's traffic passes through Cloudflare, set the SSL/TLS mode in the Cloudflare dashboard to Full or Full (strict) before adding this rule. On Flexible mode, Cloudflare talks to this server over plain HTTP, so the server always sees %{HTTPS} off and redirects forever - an endless redirect loop that never finishes loading.

Redirect loop or site not loading after this? We'll take a look.

Open a support ticket

Testing it, and the WordPress way

  • In the browser: open a private window and type the address with http://. It should end up on https:// with the padlock. The private window avoids an old redirect the browser may have kept.
  • On the command line: curl -I http://yourdomain.com should answer 301 Moved Permanently, with a Location line pointing to the https:// address.
  • On WordPress: also change WordPress Address and Site Address to https:// in Settings > General. If you would rather not edit .htaccess, an SSL plugin can do the redirect for you. Use one redirect method, not two stacked.
  • A padlock with a warning (mixed content): the page is on https, but some image, script or style is still called with http://. The redirect does not fix that: replace the old addresses in the content (on WordPress, a search and replace plugin does it in the database). The certificate itself is issued by AutoSSL in the panel, at no cost.

SEE ALSO

Why does my SSL certificate show fewer than 365 days?

How to tell if your site has been compromised

What is an SSL certificate and why does it matter?

Want a paid SSL certificate? See the options.

SSL CERTIFICATES

The padlock your customers look for.

A paid certificate adds warranty and company validation - useful for online shops and any site taking payments or customer data.

See SSL certificates

Hosting already includes free SSL for everyday use

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.60/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Security 443 What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Security 364 Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
Security 395 How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
Security 316 How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Security 368 How to activate and install a paid SSL certificate Every domain here already gets a free certificate automatically - see what an SSL certificate is. This page is only for...
Security 340 Why your IP gets blocked by the firewall (and how to avoid it) The server firewall counts failed attempts and, after a few, cuts off that address. It is not punishment or suspicion: i...