Skip to main content

How to Force HTTP Redirects to SSL

Overview​

Securing your website by converting HTTP to HTTPS is crucial for protecting user data and ensuring trust. Before implementing any redirection methods, ensure that your SSL certificate is properly installed and tested.

Method 1: HTTP Strict Transport Security (HSTS)​

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. It forces browsers to use HTTPS for all future requests once the initial connection is made.

How to Implement HSTS​

To enable HSTS, add the following line to your .htaccess file in the document root of your domain or subdomain:

Header always set Strict-Transport-Security "max-age=63072000;"

This configuration ensures that SSL is mandatory for the domain. To extend SSL enforcement to all subdomains (e.g., forum.example.com and blog.example.com), use the following directive:

Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"

Pros and Cons of HSTS​

  • Upsides:

    • Simple to implement.
    • SSL can propagate to subdomains.
    • The directive is cached in the browser, enhancing security for future visits.

  • Downsides:

    • The first request made over HTTP will not be encrypted.
    • Requires browser support for full effectiveness.

Method 2: Using mod_rewrite for Redirection​

The mod_rewrite module in Apache allows for flexible URL rewriting. You can use it to redirect all HTTP traffic to HTTPS by adding the following code to your .htaccess file:

RewriteEngine On
RewriteBase /
RewriteCond %{HTTPS} !^on$
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R,L]

Pros and Cons of mod_rewrite​

  • Upsides:
    • Highly flexible and customizable.
  • Downsides:
    • Implementation can be complex.
    • Does not automatically extend to subdomains unless they share a common parent directory.
    • May cause a redirect loop if not configured correctly.

Method 3: Configuring WordPress for HTTPS​

If you’re using WordPress, the platform generates absolute URLs based on the installation's protocol. If WordPress was installed using http://, all URLs will reflect this. To switch to HTTPS:

  1. Log in to the WordPress admin panel.
  2. Navigate to Settings > General.
  3. Update both the WordPress Address (URL) and Site Address (URL) fields from http:// to https://.

If some links, such as those in older posts, remain unchanged, you can use a third-party plugin like "Really Simple SSL" to update all URL references across your site.

Pros and Cons of WordPress Configuration​

  • Upsides:

    • Simple process within the WordPress admin dashboard.
    • A plugin can handle legacy content conversion.

  • Downsides:

    • Manual intervention is required to update settings.
    • Plugin dependency may be necessary for full conversion.

By using these methods, you can efficiently redirect HTTP traffic to HTTPS, enhancing your site's security and providing a safer browsing experience for your users.