Apache Redirect HTTP to HTTPS using mod_rewrite

Great code, exactly what I was looking for, couldn't find it anywhere on the internet, I appreciate you taking the time to explain it...

It was apparent when looking at the first snippet of config directives that this is the most elegant solution posted online.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

It appears to be working for me so far as I expect. Thank you for sharing!

I like this simple solution. I would make it even simpler though, and change the regex from "(.*)" to simply "."

"." would just capture 1 character of anything, the * moves it to any number of the previous.
".*" becoming catch all.

string: 456ab89

e.g: [0-9] catches 1 number,
giving result: 4

[0-9]* catches any string of numbers.
giving result 456

It saved a lot of time for me and it is very elegant.

I've been searching for hours for http to https redirect code and and this worked perfectly.

Thanks!

The page does redirect but the browser says too many redirects and stops loading.

Appreciated

Although changing the rewriterule slightly solves that.

Here is what I ended up with:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}:443%{REQUEST_URI}

Hope that helps someone else out there.

/Jimmy

Thanks, if you ever read this, this saved me after days of searching. The difference to previous solutions was the simple ":443" adding in the RewriteRule.

Thanks, Mario! I'm glad it helped you!

Hi! where i should put this lines? in vhosts.conf?

This should be in httpd.conf

Hi Jimmy, I'm trying but my code is failing on me. Do I need to do anything else?

Thanks! Works like a charm.

I just wanted to note that redirecting http to https also works if the https server is not Apache (for example Glassfish, Tomcat or Weblogic). So if you run apache on port 80 and Glassfish on port 443, this works as well.

Thanks for the clear code. Works perfectly in my vhost file without needing an .htaccess file.

Didn't work for me but thanks to Jimmy I got it to work. Thanks man

Thanks very much works fine, iam looking on many websites but not found, at last i reach there thanks alot.......

Thanks so much. I've been fighting this problem for days. What a relief to find a good solution!

thanks, it is work, a searching for HTTPS Off in mod_rew

I am using index.html under custom Document root to resolve uri ( I Have 2 virtual hosts)

LoadModule ssl_module modules/mod_ssl.so
Listen 443
NameVirtualHost *:443

<virtualhost *:443="">
ServerName dev.addressbook.amig.com
DocumentRoot /gw/httpd/www/ab
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}:443%{REQUEST_URI}
SSLEngine on
SSLCertificateFile /gw/httpd/security/ab/**com.crt
SSLCertificateKeyFile /gw/httpd/security/ab/**.key
SSLCertificateChainFile /gw/httpd/security/ab/**.amig.com-chain.crt
ErrorLog logs/AddressBook_ssl_error_log
TransferLog logs/AddressBook_ssl_access_log
LogLevel debug
JkMountCopy on
<directory "="" gw="" httpd="" www="" ab"="">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</directory>
</virtualhost>

and other under <directory "="" gw="" httpd="" www="" cc"="">

You are simply awesome

thanks.

I used that codes to redirect my website to https, but then my website does not display properly on chrome or firefox, but works fine on Internet explorer.

Proper way to do it -- secure way -- is to use the apache virtual host redirect:

<virtualhost *:80="">
ServerName www.example.com
Redirect / https://www.example.com/
</virtualhost>

<virtualhost *:443="">
ServerName www.example.com
# ... SSL configuration goes here
</virtualhost>

Exactly what I was looking for. Thanks!

Hello,

I've configured mysite.com and installed a ssl cert so https://mysite.com is working fine as well.
but if I create a redirect and then open the site in a browser, it says:

"The page isn’t redirecting properly
Firefox has detected that the server is redirecting the request for this address in a way that will never complete.
This problem can sometimes be caused by disabling or refusing to accept cookies."

here is my virtualhost config:
<virtualhost *:80="">
ServerAdmin example@example.com
ServerName mysite.com
ServerAlias www.mysite.com
Redirect / https://mysite.com/
DocumentRoot /var/www/mysite.com/public_html
DirectoryIndex index.html index.php
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</virtualhost>

<virtualhost *:443="">
ServerName mysite.com
ServerAlias www.mysite.com
DocumentRoot /var/www/mysite.com/public_html
DirectoryIndex index.html index.php
<directory var="" www="" mysite.com="" public_html=""/>
AllowOverride All
Order Deny,Allow
Allow from all
</directory>
SSLEngine on
SSLCertificateFile /etc/apache2/ssl-certs/mysite.com.crt
SSLCertificateKeyFile /etc/apache2/ssl-certs/mysite.com.key
SSLCertificateChainFile /etc/apache2/ssl-certs/mysite.crt
</virtualhost>

any assistance will be very much appreciated.

Jose would your site happen to be behind a proxy server using X-Forwarded-For? Because mod_remoteip that's used to resolve it does not yet detect the protocol. There is a discussion to implement it for Apache 2.5

What kind of security breach is the .htaccess method exposed to?

How to forward two domains?

<virtualhost *:80="">
ServerName www.example.com
Redirect / https://www.example.com/

ServerName www.example2.com
Redirect / https://www.example2.com/
</virtualhost>

<virtualhost *:80="">
ServerName www.example.com
Redirect / https://www.example.com/
</virtualhost>

<virtualhost *:80="">
ServerName www.example2.com
Redirect / https://www.example2.com/
</virtualhost>

Problem with this is if the initial request have path or query string, it won't get added after the redirection. Example, accessing http://www.example.com/what... will just go to https://www.example.com.

Sorry, that is just wrong. Apache will append anything after the / to the end of the redirect destination.

I agree with Bryan. but there is a way to achieve the desired result with directive "RedirectMatch":

example:
Redirect permanent / http://www.domain2.com -- redirects to only home page
RedirectMatch permanent ^/(.*)$ http://www.domain2.com/$1 -- redirects recursive pages.

Thank you. This was very helpful.

Thanks ! Question: are both needed or the second one implies the first one?

Thank you Jared! It worked like a charm.

How to redirect when Apache is being used as proxy server with these two scenario

- Backend server has no SSL enable
- Backend server has SSL enable with self HTTP to HTTPS redirection
- Backend server has SSL enable without self HTTP to HTTPS redirection (only HTPPS)

Note: I have no right to touch the backend server

Used it in my .htaccess
It works fine

Thanks alot, This helped me big time.
This was exactly what i was looking for.you are genius.

Hi,
My vendor updated the Apache to 2.2.4, from that time redirect is not working . when user type http it is not redirecting to Https. where when they use https directly it is working. apache is installed in windows server. I would kindly advice .

Worked for me :) Thanks

thanks, works fine!

Thanks! I plugged the code into my .htaccess file and it works perfectly. Thanks for this great tip and resource!

Redirection HTTP to HTTPS can be achieved in various ways like

1. mod_rewrite (as explained by your blog)

2. page redirection i.e. header(“Location:$redirect”);

3. HTML meta tag i.e.
< meta http-equiv="Refresh" content="0;URL=https://www.example.com" />

4. Port redirection using firewall (iptables,etc)
i.e. # iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth0 -j REDIRECT --to-port 443

But the thing is that i want to know which is the best method to do this. Can anyone help me out.

Well, definitely not #4. Simply changing the TCP port doesn't do what you're trying to do; you have to tell the browser to initiate a TLS session (there's nothing magical about port 443; it's perfectly possible to do unencrypted web traffic over that port).

And number 3 is a big no-no too, it is frowned upon by web crawler and will affect your Google ranking.

indeed, the refresh tag it's hard penalized by search engines!
However, seems that there is a nice way to do this right: <link rel="canonical" href="https://…"/> added in meta according to the developers recommendations from here https://developers.google.c... and make sense their explanation! i want to test it on a http//www.gsmnetcomputer.go.ro website.

Careful with canonical - it's more like a bandaid than a proper fix - it's always better to implement a proper 301 (either via htaccess or vhosts).

I think #2 is the original and best method. That sends a return code back to the browser (or spider) so it knows that the first thing it tried is not valid. You can use "Redirect 301" for a permanent redirect and web crawlers will eventually update their db and you won't lose your rankings (or you can send 302 if it's just temporary for some reason). The mod_rewrite method is clumsier and harder to read, I think, but by adding the R at the end of the rule, it also does a Redirect.

Hi Vikram, try something like this:



RewriteCond %{HTTP_HOST} .

RewriteCond %{HTTP_HOST} !^www\.yourdomain\.com &#91NC&#93

RewriteRule (.*) http://www.yourdomain.com/$1 &#91R=301,L&#93

I bought domain ssl and now I have subdomains too. But I can access subdomains using domain.com/subdomain then how can I write redirect rule for same? Please guide me.

This works good but i need to have the redirect when site domain.com is accessed it should redirect as https://www.domain.com(www is main). tried setting redirect rules but they give error.



help me with the code

I recently installed SSL certificate in my site. In effect, my site becomes inaccessible. Now, i have to redirect it from HTTP to HTTPS to make my site work again. my site is installed in a sub-directory (http://mysite.com/folder) and made a copy of htaccess & index file in the root directory to make the website accessible as (http://mysite.com). My problem is, where do i need to copy the above code? should i copy it in htaccess file in sub-directory or to the one in root directory? Thanks!

Is it safe to create a file for this httpd.conf and folder. if there is no existing file or folder for thi settings. And insert this code from this link https://www.sslshopper.com/...

Hi

I'm using Apache24 in Windows 7. The apache server works great and HTTPS access by itself works as well. I enabled mod_rewrite, but when I put the code in httpd.conf at the very end, and I access http://localhost/index.html it just gives me http page, not the https page. Note that I can access the document using https directly, so redirection does not seem to happen.

Cannot think of any other missing bits, so please help!

I don't see a reply, so I'll try, you should get an email from this.

Your rewrite rules ALWAYS have to be within a VirtualHost entry - they are not global-capable. Well, they are, but it's complicated to set that up.

Thank you so much for this! Works like a charm.

john, the httpd.conf file will already exist, but you can just create a .htaccess file to put the lines in. That is the easiest way to do it.

I couldn't get anything posted here to work. That's possibly due to a caching issue that places it's own rewrite rules above mine every time I clear the cache. Nonetheless, this continues to work for me.

RewriteEngine On
RewriteCond %{SERVER_PORT} !=443
RewriteCond %{HTTP_HOST} ^(www\.)?my-site\.com$ [NC]
RewriteRule ^$ https://my-site.com%{REQUEST_URI} [R=301,L]

This worked for me like a charm (y)

Thank you!

Hi, I wrote before asking for some help to 301 redirect HTTP TO HTTPS and force SSL to only files with certain extensions in my case, only .HTML files. Let me clarify. In my root directory are bith .pho and .html files.

I found out the other day unless I move to a VPS which I do not need to, GoDaddy hides the Apache Server access file in a Multi-Tenant or what they call a shared hosting environment. I have no idea why, no one can mess up anyone even in a shared Cloud, IMHO, GoDaddy simply is baaby sitting assuming that people will screw up the server config file and go crying to them. They may be right, but you don't all for the actions of the stupid and yes I know I can leave, but am planning to in November and to a VPS. For now, the only solution on another board someone left and never came back was to say, to 301 redirect only your .HTML files, just create a redirect for the folder they are in, They are ALL in the root directory public_HTML and foolishly I tried it and the only link out of lots of pages looked like https://www.erpsaa.com/publ... with a 505 error.

So, unless I am going mad thinking crazy stuff like make a new folder in the root directory and shove all the .HTML files in it, that must be what he meant, since I was very clar about using both .php and .html. It seems insane and I never heard of such a thing, but I wanted to ask here one more time, I've tried so many ways to be ablet to restrict myself to one command to accomadate GoDaddy's setup of only allowing 1 in the .htaccess to function, the solution I am using now because it's our busy season, until the end of May when Oracle's FY ends, that I had no choice but to put into place a Cheat and not send any site maps to Google or anyone, but that will not last long and if someone were to use http://www.erpsaa.com/ they would land on a non-secure site until they clich any Java Menu or link already uploaded. Hence my desperation.

Does anyone think I may be on the right track with this code, it's looks horrible, but seems logical.

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^apache-redirect-http-to-https\.html$ https://www.erpsaa.com/apac... [R=301,L].

I suppose I'll have to try the insane rule or move to a VPS before I get one and more of what VMware sells at no cost in November. Thanks to anyone for their help.

Dean

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Worked just fine on my cheapen server.

If you use ssl , the http will be 400 error. How to fix it and make http and https together useful?

Thank you! I've been looking for a generic https redirect solution that will work on multiple different sites using the same code, and this is it!

However, most users will probably want to add " [R=301,L]" to the end of the RewriteRule directive, so that the server issues a Permanent redirect. That will make it so browsers cache the redirect, saving your users a round-trip request on subsequent returns to the site.

great stuff; easy to use, easy to understand. many thanks

Awesome!

I made the decision to put my whole site under SSL and have an EV SSL certificate from Comodo. The site is hosted by Hostgator. I have updated all of the site URLs to HTTPS, but prior to doing this I was using the Rewrite rule:
RewriteEngine On
RewriteCond % {SERVER_PORT} 80
RewriteRule ^ (.*) $ https://flexiscreens.com/$1 [R=301,L]
Should I leave this in place, or will this create a 301 loop?

Hi John,

I am using the similar rule but its creating 301 loop. Were you able to fix for your site. In my case site is available on both http & https. But I have to force user to HTTPS.

Thanks,
Umesh

Hi Umesh,
No problems so far. I think when i first inserted the rule, not all of the site had the GUID set to https, some were still http and when i did a link check with Xenu's link checker, it came up with 301 loops. Since setting all URLs to https, this is not a problem. Is there a reason you still want to use http? Google are using https as a ranking signal now.

Thanks! This fixed it for me!

Nothing worked for me...:( i probobly dont know where in the config file to add it... and i'm trying to redirect http://my.site.com:1025 to https://mysite.com:1025 so could be the port is causing the issue?? can anyone help?

It should still work with the port. Maybe try some of the suggestions or other methods listed at http://serverfault.com/ques...

Using VM its redirect my war file but cannot redirect outside when access the will show me as Tomcat index page..what is the problem help me?

<virtualhost *:80="">

ServerName example.in

Rewriteengine on

RewriteRule ^/$ http://example.in/War File Name/

ProxyPass /War File Name http://localhost:8080/War File Name

ProxyPassReverse /War File Name http://localhost:8080/War File Name

</virtualhost>

I have an application working on URL http://pre.example.com:8080... . I want to redirect all request to https://pre.example.com:844... . I have added below code-snippet to /etc/httpd/conf/httpd.conf file.
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

But it did not work for me. Please correct me if I am doing wrong.

You have to create a .htaccess file in your web document root like in /var/www/

You can use

Redirect / http://pre.example.com/
see https://httpd.apache.org/do...
HTH
Miles

Firstly it needs to go in your virtualhosts directive inside httpd.conf. Make sure its the one for port 80

< VirtualHost 100.100.100.100:80 >

...

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]

...

</virtualhost>

Sometime, if use setting like that, not all page or post direct to https. if i try manuali type my website address like http://baguz.net/info/topik... not automatic direct to https.

Be aware that REQUEST_URI does not include the query string! I suggest a different rewrite pattern.

Thanks, Erica. I'll get that updated.

Type: figured on my site http://www.bluepointseo.co.uk/ ha - second % mark shouldn't be there. Not in the first block of code anyhow when inserted into .htaccess

I am using Lets Encrypt SSL Certificate for my domain http://www.phoneunlockit.com/ everything is working fine, and added the above code into my .htaccess file to redirect it.
Thank you very much.....

In my situation (https://slowianskibestiariu... I had to add this line - RewriteCond %{SERVER_PORT} !^443$
Also I have question: it's wrong if I have two times used "RewriteEngine On" in my htaccess?

I'm pretty sure it doesn't hurt to have several RewriteEngine On. It's just to be sure, as it might not be on already.

In my server apache running on windows,
NOTE that i have a XAMPP with apache 2.4 and SNI
I wrote my VirtualHost in the ""httpd-vhosts"" as follow

<virtualhost *:80="">
ServerAdmin you@yourdomain.com
DocumentRoot "where your files are"
ServerName yourdomain.com
ServerAlias www.yourdomain.com
<directory where="" your="" files="" are="">.
Require all granted
</directory>
ErrorLog "logs/yourdomain.com-error.log"
CustomLog "logs/yourdomain.com-access.log" common
Redirect permanent / https://www.yourdomain.com/
</virtualhost>

ALSO INCLUDE A VIRTUAL HOST LIKE THIS

<virtualhost *:443="">
ServerAdmin you@yourdomain.com
DocumentRoot "where your files are"
ServerName yourdomain.com
ServerAlias www.yourdomain.com
<directory where="" your="" files="" are="">.
Require all granted
</directory>
ErrorLog "logs/yourdomain.com-error.log"
CustomLog "logs/yourdomain.com-access.log" common
SSLEngine on
SSLCertificateFile "PATH TO YOUR CERTIFICATE /certificate.crt"
SSLCertificateKeyFile "PATH TO YOUR PRIVATE KEY /private.key"
SSLCertificateChainFile "PATH TO YOUR CA BUNDLE /ca_bundle.crt"
</virtualhost>

WITH THIS I CAN REDIRECT ALL MY TRAFFIC TO MY HTTPS SITE BUT ALSO SINCE I'M RUNNING APACHE 2.4 WITH SNI I CAN HOST SEVERAL WEBSITES WITH THEIR OWN SSL CERTIFICATES.

One of my clients have installed SSL certificate on his site, but after that all the third party scripts & iframe installed on his website are not accessible and became invisible. I can't understand how to make them visible again. If you have any solution about the same, kindly let me know.

It is probably because they are served over HTTP. Many browsers block HTTP requests on HTTPS sites. The easiest solution would be to change the http part of the URLs to https.

I think there's a typo in the first code block. In the RewriteRule directive "%$1" should be "$1" instead?

Thanks, Nick! I'll get that fixed.

just try like this, point is
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

copy this past until the end ->

see: http://hargaspeksifikasi.net

let's copy this:

RewriteEngine On

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

That doesn't work on all web browser. I made my own version for that and I do recommend is using this slightly edited version:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{SERVER_PORT} 80
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]

this is not working on centos 7 / apache 2.4
use:
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

I was getting a double trailing slash i.e. // suffixed to the redirected URL which looked bad in the browser address bar.

I fixed it by removing the '/' before the $1 and everything seems to work well, including when query parameters are passed along with the URL.

I am using this code. Is this correct. And is it the best.

# BEGIN WordPress
<ifmodule mod_rewrite.c="">
RewriteEngine On
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</ifmodule>
# END WordPress

thanks man. this saves me :D :D :D

Hi Pcriver , Could you please tell me where i need to add this code ?

Exactly what I wanted - redirect to https only when domain was the name, in order to allow development LAN machines to access via IP and use http.

Thank you muchas

RewriteEngine on
RewriteCond %{SERVER_NAME} =domain name
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

Add this line to your Virtual host file. It will redirect it to https.

Hi,
Should I change any variable of the code above or any code related to this function that the friends wrote? E.g. to put my domain instead or something like that
Thanks in advance.

With your below suggestion:-
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]

How to redirect:-
cppbuzz.com to https://www.cppbuzz.com
www.cppbuzz.com to https://www.cppbuzz.com
http://www.cppbuzz.com to https://www.cppbuzz.com

Thanks for this post, it works brilliantly

How would i write a regex statement that would not only set the condition to HTTPS off, but also to store the subdomain portion as a variable? The two examples I am trying to put together are :

RewriteEngine On
RewriteCond %{HTTP_HOST} ^(.*)\.example.com [NC]
RewriteRule ^(.*)$ https://%1.example.com:443/$1 [QSA,R=307,L]

and

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]

RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]

doesn't work. redirect to https://host// then get 404
i think $1 already contains a slash

The rule with the slash seems to work for me so I think there is some other issue on your end.

I am trying to set the webapp using Apache (Server version: Apache/2.4.38 (Unix)) with SSL and Tomcat (Apache Tomcat/8.5.41). when i am hitting abcd.domain.com/search then it receives error as "The proxy server received an invalid response from an upstream server." please suggest what is wrong in the below configuration settings.

3 tomcat instances are set as str1, str2, str3 with below settings with jvmroute respectively. Server.xml as:

Connector port="8988" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443"
Connector port="8010" protocol="AJP/1.3" redirectPort="8443"
Engine name="Catalina" defaultHost="localhost" jvmRoute="str1"
In Httpd.conf with SSL module enabled and pointing httpd-ssl.conf

Listen 80
ServerName abcd.example.com:80
RewriteEngine On
RewriteCond %{SERVER_PORT} =80
RewriteRule (.*) https://abcd.example.com/se... [R=301,L]
In httpd-ssl.conf

Listen 443
SSLEngine on
ServerName abcd.example.com:443
In Proxy-balancer.conf:

ProxyPass /search balancer://stcluster/search
ProxyPassReverse /search balancer://stcluster/search
<proxy balancer:="" stcluster="">
BalancerMember http://localhost:8988 loadfactor=1 route=str1
BalancerMember http://localhost:8987 loadfactor=1 route=str2
BalancerMember http://localhost:8986 loadfactor=1 route=str3
ProxySet lbmethod=bybusyness
ProxySet stickysession=JSESSIONID|jsessionid
ProxySet timeout=300
</proxy>

I am running CWP Panel on my VPS Server. I have also enabled AutoSSL for all my clients. Is it possible to redirect http to https for all domains of my clients in a Auto single command?