Force HTTPS: Redirect HTTP to HTTPS

Once your domain has an SSL certificate, send visitors who type http:// to https:// automatically. Browsers stop showing "Not secure", and search engines index a single version of each page.

Before you start

The domain must already have a working certificate. Open https://yourdomain.com in your browser. If you see a certificate warning, a 403 error, or another site, fix SSL first. Redirecting to HTTPS without a certificate takes the site offline for visitors.

If you use WordPress, check Settings → General in WordPress: both addresses should start with https://. Many SSL plugins can also do this redirect; use one method, not both.

Add the redirect

1. Open the file manager from the hosting control panel.
2. Go to the site's html folder (yourdomain.com/html).
3. Open .htaccess, or create it if it doesn't exist (New Item → file named .htaccess). If it already exists, download a copy first.
4. Add these lines at the top of the file, above any # BEGIN WordPress block:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

5. Save.

This keeps the path and query string (http://yourdomain.com/contact?x=1 goes to https://yourdomain.com/contact?x=1) and works for every domain that uses that folder. 301 tells search engines the move is permanent.

Check it

1. Open a private browser window.
2. Go to http://yourdomain.com/some-page.
3. The address bar should change to https://yourdomain.com/some-page and show the padlock.

You can also run curl -I http://yourdomain.com and look for 301 and a Location: https://… line.

Also send www to one version (optional)

To always use https://yourdomain.com without www, use this instead of the block above (change yourdomain\.com):

RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} ^www\.yourdomain\.com$ [NC]
RewriteRule ^ https://yourdomain.com%{REQUEST_URI} [L,R=301]

Make sure the certificate covers both yourdomain.com and www.yourdomain.com.

If something goes wrong

• "Too many redirects": you have two redirects fighting (a plugin and .htaccess, or the WordPress address still on http://). Remove one.
• 500 error after saving: a typo in .htaccess. Restore your copy, then paste the lines again.
• Another site or a 403 over HTTPS: the domain has no certificate. Remove the redirect and see Troubleshoot website errors.

More about the file: Edit the .htaccess file.