htaccess redirect all traffic to secure non www version of page

Question

I'm having trouble with my .htaccess redirects.

I need to forward all URLs to the non www version of the URL using HTTPS and also forward any non secure URLs to HTTPS too. In both cases I need to keep the full URL

I currently have these rules which almost work as I want but they seem to redirect any www traffic to the homepage rather than keeping the rest of the URL.

eg:

http://www.example.com/mycat/mypage.php

would goto

https://example.com/mycat/mypage.php

My current code:

RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_METHOD} !=POST
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

I tried the rules off this link but they seem to get stuck in a redirect loop

htaccess redirect non-www to www with SSL/HTTPS

RewriteCond %{HTTP_HOST} !^www\.
RewriteRule .* https://www.%{HTTP_HOST}% {REQUEST_URI} [L,R=301]
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

With HSTS (double redirect):

RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} 
[L,R=301]
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule .* https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Answer 1

Try this:

RewriteCond %{HTTPS} off 
RewriteRule ^(.*) https://example.com/$1 [R=301,L]

RewriteCond %{HTTP_HOST} ^www.example.com [NC]
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

Answer 2

You already have your answer, but just to comment on points raised in your question...

RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_METHOD} !=POST
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This is a "specialised" redirect. You should only be testing the X-Forwarded-Proto HTTP request header, if you know you are behind a front-end proxy that is managing your secure connection. Otherwise your site is susceptible to a MITM that would prevent the connection being redirected to HTTPS.

This also, potentially, allows insecure POST requests. (Probably to prevent them being "lost" over a 301 redirect - but this is not a "secure" practise.)

I tried the rules off this link but they seem to get stuck in a redirect loop

As stated in the title of that question, those rules do the opposite of what you are trying to achieve. They redirect to the www subdomain, not the domain apex - which would appear to be your goal. If your site/CMS itself canonicalises the hostname (like what WordPress does) then you will get a redirect loop.

Answer 3

This is what I use to direct to secure www. version:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [L,R=301]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.%{SERVER_NAME}/$1 [L,R=301]

Leading me to think this would work to send you to a secure non-www version:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [L,R=301]
RewriteCond %{HTTP_HOST} ^www\.([a-z-.]+?)\.?$ [NC]
RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [L,R=301]

I am unable to find the rules I wrote for a site when I had it redirecting to non-www as my clients prefer the url with the www.

Give it a try and let me know if it works, failing that solution I can try provide other work arounds.