2

I am setting up a new site on a domain that has an SSL certificate. The DNS is all configured correctly and I can access the site on either http://example.com or https://example.com URLs.

Currently, it is redirecting http://example.com to https://example.com and http://www.example.com to https://example.com.

However, I don't really understand how that is working because it works even if I delete the .htaccess file. If I do change the .htaccess to redirect using any of the techniques that I've come across then I get a "too many redirects" error. There must be something else going on that I don't understand.

Ideally, I'd like it to redirect http://example.com/anything to https://example.com/anything

Any ideas?

My server is using CentOS 6.6. Output from "uname -r":

2.6.32-504.12.2.el6.x86_64

Can provide further information if needed.

Added example of .htaccess code that caused "too many redirects":

RewriteCond %{HTTP_HOST} ^example.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]
2
  • 1
    "it works even if I delete the .htaccess file" - Isn't your web application issuing the redirect? Also, bear in mind that the browser will cache 301 redirects. You can't do this type of redirect (HTTP to HTTPS) using cPanel's "redirect interface". When you use cPanel to create a redirect, it simply edits the .htaccess file for you. Please include the .htaccess code you tried (that results in the "too many redirects" error).
    – MrWhite
    Jul 10, 2018 at 18:21
  • I've updated my question with an example of the redirect that I tried. By the way we are using Wordpress - as you say it might be the case that it is doing the redirect. I won't get a chance to do any more testing for another few days to verify this but it is a good suggestion.
    – Alan Spark
    Jul 11, 2018 at 12:48

2 Answers 2

2

It's quite probable that your web application (ie. WordPress - mentioned in comments) is already issuing the appropriate HTTP to HTTPS and www to non-www redirects. However, using .htaccess is arguably more efficient *1, and your web application may not be issuing the correct redirect(s) if you are planning on implementing HSTS.

(*1 - Although using your main server config would be preferable.)


Added example of .htaccess code that caused "too many redirects":

RewriteCond %{HTTP_HOST} ^example.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

This isn't a HTTP to HTTPS redirect (in fact, it isn't anything) and will certainly result is a redirect loop (ie. "too many redirects" browser error). It basically says, if the requested host is example.com then redirect to example.com (irrespective of protocol). So, it just redirects to itself.

As mentioned in comments, you can't implement HTTP to HTTPS redirects using the cPanel "redirect" interface. You can only perform very simple redirects using the cPanel interface, which is far from perfect and not without its caveats. And if you are using WordPress then you can't even configure simple redirects using cPanel with some manual editing of the .htaccess file. (cPanel always adds the redirect code at the end of the .htaccess file - which is notably after the WordPress front-controller. So in most cases the redirect directives are never processed anyway. The cPanel documentation notifies you of this.)

Any redirect directives you add (using mod_rewrite) to your .htaccess file, must go before the WordPress front-controller, ie. at the top of your .htaccess file.

If you are planning on implementing HSTS then the HTTP to HTTPS redirect must redirect to the same host, so the HTTP to HTTPS should go before (and be separate from) the canonical www/non-www redirect. See @jcanepa's answer for the appropriate HTTP to HTTPS redirect in this scenario. You can then follow this with a www to non-www redirect (which appears to be your canonical hostname). For example:

# www to non-www redirect only
# (NB: This must go AFTER the HTTP to HTTPS redirect if implementing HSTS)
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule .* https://example.com%{REQUEST_URI} [R=301,L]

If, however, you have no intention of implementing HSTS then you can combine the HTTP to HTTPS and www to non-www canonical redirect in a single redirect instead (which prevents a potential second redirect). For example:

RewriteEngine On

# HTTP to HTTPS and www to non-www
# (NB: Not suitable for HSTS)
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule .* https://example.com%{REQUEST_URI} [R=301,L]
1
  • 1
    Thank you very much, your last example is exactly what I need. I have just tested it and it works perfectly. I had tried something similar before but the key point was adding it to very top of the .htaccess, I never would have figured that out.
    – Alan Spark
    Jul 13, 2018 at 11:38
2

If apache, I'd recommend implementing an .htaccess at the root of your site:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
1
  • Thanks, I'm sure I tried something like this. I will not be able to do further testing for another few days but I will give it a try at the next opportunity.
    – Alan Spark
    Jul 11, 2018 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.