Stop redirecting HTTPS to HTTP on Apache
Why it matters
The HTTPS homepage sends visitors back to plain http, so the encrypted connection is thrown away and their traffic is exposed again. It usually means the application believes its address starts with http:// or a redirect rule points the wrong way.
The fix
- Search the *:443 virtual host and any .htaccess for Redirect or RewriteRule lines whose target starts with http:// and change them to https://.
- If Apache proxies to an application, tell it the original scheme with the line below in the *:443 virtual host (mod_headers), then reload Apache.
apache
RequestHeader set X-Forwarded-Proto "https" Related
- Reported by the HTTP to HTTPS redirect check
- Serve the site over HTTPS
- Redirect HTTP to HTTPS
- Fix the broken HTTPS redirect chain
- Shorten the redirect chain
- Fix the HTTP redirect chain
- Redirect HTTP straight to HTTPS
- Answer HTTP with a redirect to HTTPS
- Redirect www and apex to one host
- Make the www or apex name work over HTTPS
Scan your domain to see whether this applies to you.