Right now my domain www.example is setup to force HTTPS and it works. The site also correctly links everything to HTTPS. (there are no occurences of HTTP in the database anywhere).

But if you are visiting a subpage, you can change the url to HTTP again, for example / and it will not enforce HTTPS.

I have this rule in my .htaccess in the root:

RewriteEngine On 
RewriteCond %{HTTP_HOST} ^example [NC]
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ /$1 [R,L]

Any ideas what the cause of this is?

Right now my domain www.example is setup to force HTTPS and it works. The site also correctly links everything to HTTPS. (there are no occurences of HTTP in the database anywhere).

But if you are visiting a subpage, you can change the url to HTTP again, for example http://example/subpage/ and it will not enforce HTTPS.

I have this rule in my .htaccess in the root:

RewriteEngine On 
RewriteCond %{HTTP_HOST} ^example [NC]
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://example/$1 [R,L]

Any ideas what the cause of this is?

• htaccess
• ssl
• https

Share Improve this question edited Apr 14, 2019 at 11:10 norman.lol 3,24133 gold badges3030 silver badges3535 bronze badges asked Jul 20, 2017 at 22:43 RizzahRizzah 3333 bronze badges

Add a comment  | 

2 Answers 2

Sorted by: Reset to default 2

To globally redirect all your pages to HTTPS add the following lines to your .htaccess:

# Globally force SSL.
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This should be placed directly after RewriteEngine on if you have no previous rewrites.

Try this htaccess rule

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]