How is it best to redirect http to https in cPanel?

Question

I am setting up a new site on a domain that has an SSL certificate. The DNS is all configured correctly and I can access the site on either http://example.com or https://example.com URLs.

Currently, it is redirecting http://example.com to https://example.com and http://www.example.com to https://example.com.

However, I don't really understand how that is working because it works even if I delete the .htaccess file. If I do change the .htaccess to redirect using any of the techniques that I've come across then I get a "too many redirects" error. There must be something else going on that I don't understand.

Ideally, I'd like it to redirect http://example.com/anything to https://example.com/anything

Any ideas?

My server is using CentOS 6.6. Output from "uname -r":

2.6.32-504.12.2.el6.x86_64

Can provide further information if needed.

Added example of .htaccess code that caused "too many redirects":

RewriteCond %{HTTP_HOST} ^example.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

Answer 1

It's quite probable that your web application (ie. WordPress - mentioned in comments) is already issuing the appropriate HTTP to HTTPS and www to non-www redirects. However, using .htaccess is arguably more efficient ^*1, and your web application may not be issuing the correct redirect(s) if you are planning on implementing HSTS.

^{(*1 - Although using your main server config would be preferable.)}

---

Added example of .htaccess code that caused "too many redirects":

RewriteCond %{HTTP_HOST} ^example.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

This isn't a HTTP to HTTPS redirect (in fact, it isn't anything) and will certainly result is a redirect loop (ie. "too many redirects" browser error). It basically says, if the requested host is example.com then redirect to example.com (irrespective of protocol). So, it just redirects to itself.

As mentioned in comments, you can't implement HTTP to HTTPS redirects using the cPanel "redirect" interface. You can only perform very simple redirects using the cPanel interface, which is far from perfect and not without its caveats. And if you are using WordPress then you can't even configure simple redirects using cPanel with some manual editing of the .htaccess file. (cPanel always adds the redirect code at the end of the .htaccess file - which is notably after the WordPress front-controller. So in most cases the redirect directives are never processed anyway. The cPanel documentation notifies you of this.)

Any redirect directives you add (using mod_rewrite) to your .htaccess file, must go before the WordPress front-controller, ie. at the top of your .htaccess file.

If you are planning on implementing HSTS then the HTTP to HTTPS redirect must redirect to the same host, so the HTTP to HTTPS should go before (and be separate from) the canonical www/non-www redirect. See @jcanepa's answer for the appropriate HTTP to HTTPS redirect in this scenario. You can then follow this with a www to non-www redirect (which appears to be your canonical hostname). For example:

# www to non-www redirect only
# (NB: This must go AFTER the HTTP to HTTPS redirect if implementing HSTS)
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule .* https://example.com%{REQUEST_URI} [R=301,L]

---

If, however, you have no intention of implementing HSTS then you can combine the HTTP to HTTPS and www to non-www canonical redirect in a single redirect instead (which prevents a potential second redirect). For example:

RewriteEngine On

# HTTP to HTTPS and www to non-www
# (NB: Not suitable for HSTS)
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule .* https://example.com%{REQUEST_URI} [R=301,L]

Answer 2

If apache, I'd recommend implementing an .htaccess at the root of your site:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]