# IIS URL Rewrite http to https EXCEPT files in a specific subfolder

I am trying to force all traffic on my web site to use HTTPS, using the URL Rewrite 2.0 module added to IIS 7.5. I got that working and now have a need to exclude a couple of pages from using SSL. So I need a rule to rewrite all URL except those referencing this folder to HTTPS. I've been banging my head against the wall on this and am hoping someone can help. I tried creating a rule to match all URL except those in a nossl subfolder as in this example:

<rule name="HTTP to HTTPS redirect" enabled="true" stopProcessing="true">
<match url="(/nossl/.*)" negate="true" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
<add input="{HTTPS}" pattern="off" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
</rule>


But this doesn't work. Can anyone help?

## 3 Answers

If anyone is curious I resolved this problem with the following syntax:

<rule name="NoSSL - folder" enabled="true" stopProcessing="true">
<match url="^nossl/.*" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
</conditions>
<action type="None" />
</rule>
<rule name="Redirect to HTTPS" enabled="true" stopProcessing="true">
<match url="(.*)" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
<add input="{HTTPS}" pattern="off" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
</rule>

• Brett, I was looking for this exact thing, so thanks! However it appears that this doesn't work if the user browsing the site is using anything but IE. Did you run into this and if so what was your resolution? Thanks – user16526 Jun 25 '12 at 12:36
• Seth, this has worked perfectly for us for over a year now. We have seen no issues with any browsers. We are running IIS 7.5 on Server 2008 R2. – BrettRobi Jun 25 '12 at 15:51

Although I'm a bit late to the party, I would like to suggest this syntax, which is a bit shorter (and IMHO cleaner) than the accepted one:

<rule name="Redirect to HTTPS except /nossl/ folder" enabled="true" stopProcessing="true">
<match url="(.*)" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
<add input="{REQUEST_URI}" url="^nossl/.*" negate="true" />
<add input="{HTTPS}" pattern="off" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
</rule>

• I like the elegance of this solution, however, I get a 500 error when I try to implement it. The first <add input="{REWRITE_URI}... condition is what triggers the error. – Dave L Jan 6 '20 at 20:57
• @DaveL it should be {REQUEST_URI}: fixed the code snippet accordingly. – Darkseal Jan 7 '20 at 1:49

Adding this condition <add input="{REQUEST_URI}" url="^nossl/.*" negate="true" /> resulted in a 500 Internal Server error. After reading the documentation a bit more I changed it to this and had a better result.

<rule name="Redirect to HTTPS except nossl folder" stopProcessing="true">
<match url="(.*)" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
<add input="{REQUEST_URI}" pattern="^nossl" matchType="Pattern" negate="true" />
<add input="{HTTPS}" pattern="off" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
</rule>

• I believe the pattern should be more like the following to actually match URLs in the nossl folder pattern="^/nossl/.*" – dezdez Mar 4 '20 at 1:47