Force Secure (SSL) Pages With .htaccess

By  on  

Updated 11/3/2015: Added R=301 to ensure redirects are 301 permanent.

A while back, I shared a method for forcing a secure page using PHP. What if you want to force SSL (https://) on an entire website though? You don't want to have to put force-SSL PHP code on every page, right? Well, the website's .htaccess file comes to the rescue.

The .htaccess Code

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://domain.com/$1 [R=301,L]

Obviously, you'll want to change "domain.com" to your domain. Another short snippet of code that has a big impact on your website!

Recent Features

  • By
    Camera and Video Control with HTML5

    Client-side APIs on mobile and desktop devices are quickly providing the same APIs.  Of course our mobile devices got access to some of these APIs first, but those APIs are slowly making their way to the desktop.  One of those APIs is the getUserMedia API...

  • By
    Introducing MooTools Templated

    One major problem with creating UI components with the MooTools JavaScript framework is that there isn't a great way of allowing customization of template and ease of node creation. As of today, there are two ways of creating: new Element Madness The first way to create UI-driven...

Incredible Demos

  • By
    Create a Spinning, Zooming Effect with CSS3

    In case you weren't aware, CSS animations are awesome.  They're smooth, less taxing than JavaScript, and are the future of node animation within browsers.  Dojo's mobile solution, dojox.mobile, uses CSS animations instead of JavaScript to lighten the application's JavaScript footprint.  One of my favorite effects...

  • By
    MooTools 1.2 Image Protector: dwProtector

    Image protection is a hot topic on the net these days, and why shouldn't it be? If you spent two hours designing an awesome graphic, would you want it ripped of in matter of seconds? Hell no! That's why I've created an image...

Discussion

  1. Great tip but what if you have more than one domain to the same website? For example, you have davidwalsh.name now, but you could have had the domain davidwalsh.com too. How would you change the script so that it worked on both of your domains?

  2. If you have a website that uses the www. prefix (the standardized way for top level domains) add www. into the .htaccess code. Otherwise Google will penalize you for duplicate content (your entire site would be one whole duplicate).

    Great tip!

    • Good point!

      And nice tip

  3. Jon

    Thanks for the venue.
    I’m new to this web admin topic and would like some clarity on what is probably a very simple question for experienced webmasters.

    is it correct that using basic authentication (.htaccess + htpassword) on an Apache server that allows only ssl will not result in clear text being sent from the browser to the server .. since after all it is an ssl connection?

    Also, in general, is htaccess a reasonable way to secure directories given a 100% ssl site?

    Thanks.

  4. Thanks a lot..
    I was searching this kind of thing….

  5. Chris

    Will this script work with subdomains and wildcard SSL certificates?

    yourwebsite.com
    subdomain1.yourwebsite.com
    subdomain2.yourwebsite.com

  6. When you force an SSL page for your website you also want to be sure and have any adds that are directed to your site to already include the https:// in the link to your site. Many search engine advertising sites are touchy with redirection even if it is only to send you to a secure page directly. This .htaccess code I believe will work on subdomains (remember you require a certificate for each subdomain from your web host service installed first), but you need to put the .htaccess code in each of your subdomains main folder. Thanks for the great article! =)

  7. George

    Is there a way to exclude ONE page from the global https? If there is one page that I want to keep http, how would I go about doing that?

    Thanks for this tip!

  8. Frank

    I find SSL completely unconfigurable on Apache. What one would call SSL hell !

  9. hello,
    i have several page, for example, domain/mypage1 and domain/mypage2
    how do i configure htaccess so when i come to domain/mypage2 i will redirect to https connection,

    yes i have working well installed working well comodo SSL and had dedicated IP.

  10. Thank you, this came in handy today.

  11. NotI

    /me thinks the following is much better

    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
    

    it re-writes based on incoming host and request uri

  12. Thanks a bunch, that last commenter Notl’s method worked perfect for me in my case.

    Thanks!

Wrap your code in <pre class="{language}"></pre> tags, link to a GitHub gist, JSFiddle fiddle, or CodePen pen to embed!