Hold my hand through my htaccess http to https redirects

Question

I've been researching the best way to handle my htaccess file in order to switch from http requests to https and I've seen everything from basing requests off server ports, using server name requests rather than entering in an actual domain, to editing my apache configuration file and disregarding htaccess completely.

My goal is, of course, the most SEO friendly way to achieve http to https!

Here is my current htaccess rules:

Options +FollowSymLinks 
RewriteEngine on 
RewriteCond %{HTTP_HOST} ^example.com [NC] 
RewriteRule ^(.*)$ http://www.example.com/$1 [R=301]
RewriteRule ^$ /index.html [L]

So what is the most elegant way to make this code force https? This is what I have come up with so far, though untested beyond this tool

Options +FollowSymLinks 
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://www.example.com/$1 [R=301,L]
RewriteRule ^$ /index.html [L]

Answer 1

You do not need rewriting rules for such a simple case, but you can certainly achieve the same goal with them too.

In the specific VirtualHost describing the HTTP host (hence having a :80 at end of address), you just need to have:

RedirectPermanent / https://www.example.com/

See https://httpd.apache.org/docs/2.4/mod/mod_alias.html#redirectpermanent and you have the Temporary version too if you dislike the Permanent one.

Per the documentation, RedirectPermanent X Y is the same as Redirect permanent X Y and permanent is defined as:

Returns a permanent redirect status (301) indicating that the resource has moved permanently.

Also, if you can, indeed editing your Apache configuration and getting rid of .htaccess files is a good direction for many reasons (performances, security, simplicity)

Answer 2

I've seen everything from basing requests off server ports, using server name requests rather than entering in an actual domain, to editing my apache configuration file and disregarding htaccess completely.

Apart from there being "many ways to skin a cat" (because Apache config files are a very flexible/complex beast), the method that is "best" for you can be dependent on many other factors:

• Your server configuration. (eg. is UseCanonicalName On set?)
• Do you have access to the main server config or <VirtualHost> container? Or are you restricted to .htaccess (eg. a shared server environment).
• Are you running your site off non-standard ports?
• Are you hosting multiple domains off the same vHost?
• Do you need a generic solution that doesn't explicitly include the hostname? Do you want a solution that can be copy/pasted between hosts? Although a "generic" solution isn't necessarily the best (or "safest") solution for any one host. (Explicitly hardcoding the hostname is often the "safest" solution when anyone is suggesting a method to use, as we don't know how your server is configured.)
• Are you planning on implementing HSTS? (If so, then you probably don't want to canonicalise the hostname at the time you redirect from HTTP to HTTPS.)
• How is the security certificate managed for your site? eg. Is the SSL cert installed directly on your application server or are you using an SSL proxy (eg. Cloudflare)? If you are behind an SSL proxy then the HTTPS and SERVER_PORT server variables are probably no good to you. (Some hosts set alternative environment variables to help - but this is server specific.)

So what is the most elegant way to make this code force https?

Well, "elegance" can be subjective.

If you have access to the server config then you shouldn't really be doing this in .htaccess. Instead, you should be using a simple mod_alias Redirect in the relevant <VirtualHost> container - as @PatrickMevzek suggests. This is both "simpler", "safer" and more efficient.

If you later want to implement HSTS (and particularly to get on the HSTS preload list) then this really does become easier to implement in the main server config. To implement this in .htaccess requires additional complexity.

RewriteCond %{HTTPS} off
RewriteRule (.*) https://www.example.com/$1 [R=301,L]

Otherwise, if you only have access to .htaccess then there is really nothing "wrong" with the directive you are suggesting - providing it works. But bear in mind that this won't necessarily work on every server, or be the correct solution in every scenario, and could potentially be (inadvertently) overridden if you have additional .htaccess files in subdirectories.

---

RewriteRule ^$ /index.html [L]

Aside: This rule should be unnecessary providing you have the DirectoryIndex set correctly? (Unless maybe you have something "special" going on?)

Answer 3

Another option;

RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Answer 4

You're very close. This is what I use on one of the domains I take care of it and it works flawlessly.

RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://www.example.com/$1 [L]