Redirect HTTP straight to HTTPS on Apache

Why it matters

The first redirect from http:// goes to another http:// address, so the visitor's request travels unencrypted twice before reaching https. The name the visitor typed also never gets an HSTS header, which is only honoured over https.

The fix

1. The rules below need mod_rewrite (on Debian and Ubuntu: sudo a2enmod rewrite). Make the *:80 virtual host redirect every name to https on the requested host, and do the www or apex redirect in the *:443 virtual host. Run sudo apachectl configtest and reload Apache.

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    RewriteEngine On
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</VirtualHost>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Serve the site over HTTPS
• Stop redirecting HTTPS to HTTP
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS