Redirect HTTP to HTTPS on Apache

Why it matters

Visitors who type the bare domain or follow an old link land on the unencrypted site and stay there. A permanent redirect sends every http request to the same page over https.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: confirm the *:443 virtual host serves every page correctly.
2. If the site is behind Cloudflare or another CDN that connects to this server over plain http (Cloudflare Flexible mode), this redirect loops. Switch the CDN to Full (strict) first, or redirect at the CDN instead (Always Use HTTPS).
3. Stage 2: make the *:80 virtual host redirect, as below, and reload Apache. On shared hosting without access to the virtual host, put these lines at the top of .htaccess instead (mod_rewrite): RewriteEngine On, RewriteCond %{HTTPS} !=on, RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]. Behind a CDN or proxy that terminates HTTPS, %{HTTPS} is always off, so redirect at the CDN instead.

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Serve the site over HTTPS
• Stop redirecting HTTPS to HTTP
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Redirect HTTP straight to HTTPS
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS