How to [properly] redirect HTTP to HTTPS Using .htaccess

A lot of web sites already moved and a lot of old sites will move from HTTP to HTTPS protocol eventually.

After web site is moved to SSL your site still will be getting traffic directed to old HTTP. Why? Because your web site probably has backlinks http://yoursite.com from other websites.

The best solution is to contact owners of those websites and ask them to change links from http://yoursite.com to https://yoursite.com. But often it is hard to reach the owners and you can’t do anything about it.

So you won’t be able to update all off site backlinks, but do your best and setup http to https redirect for the rest of your incoming traffic.

How to setup HTTP to HTTPS redirect

If you are using any CDN service that service should do the trick with a click of one button and rewrite all incoming HTTP traffic to HTTPS. It doesn’t always work unfortunately. Earlier I wrote about problems with Cloudflare SSL settup for WordPress sites. I wasn’t able to setup Cloudflare SSL for this – Blogging Tips website.

You should modify your .htaccess file if you are not using any CDN and your hosting company doesn’t offer any SSL rewrites in control panel.

But you must to insert correct code. On internet you’ll find a lot of different versions of redirects.

This is an example of bad code. DON’T USE IT !

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

This is CORRECT CODE:

RewriteEngine On
# This will enable the Rewrite capabilities
RewriteCond %{HTTPS} !=on
# This checks to make sure the connection is not already HTTPS
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L]

Code looks very similar, but there is a big and essential difference. Can you spot it?

The difference is at the end on the last line – [R,L] vs [R=301,L].

By default a lot of webmasters are leaving R parameter with default value. But default value is 302 (click here for RewriteRule documentation).

Code 302 means “The requested resource resides temporarily under a different URI”. Read more here.

Read it again – “The requested resource resides TEMPORARILY under a different URI”

But you want permanent redirect, right? That’s why you need to write R=301

Don’t make this mistake as it can be bad for SEO of your site.