Skip to content

Redirect HTTP to HTTPS on an Apache Website

Redirect HTTP to HTTPS on an Apache Website

Use a server-side redirect only after HTTPS is already working with a valid certificate. Redirecting first can make the site inaccessible if TLS has not been configured correctly.

Apache .htaccess example

For a typical Apache site where mod_rewrite is available, add this near the top of the site’s .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Checks before using 301

  • Test the HTTPS version directly first.
  • If the site is behind a reverse proxy or CDN, the origin may see HTTP even when the visitor used HTTPS. In that design, use the hosting/CDN HTTPS redirect feature or the proxy-aware rule recommended by that platform.
  • Take a copy of the current .htaccess file before editing.

Verify

Open an HTTP URL in a private browser window and confirm it reaches the same path on HTTPS. Also test the home page, a deep link and any WordPress login/admin URL. A redirect loop means the proxy/origin HTTPS detection needs adjustment.