I want to redirect all website urls to https. I used the code below to do so. My website is built up using simple PHP. I don't use any opensource framework or CMS.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE] 

but, that's not working and throws the following error:

page not responding. redirected too many times.

  • 1
    Make sure you clear your browser cache between tests. 301 permanent redirects get aggressively cached. Changing redirects can cause redirect loops between stale cached redirects. Clearing your browser cache between each test ensures that you are testing only the current setup. – Stephen Ostermiller May 13 at 10:21
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE] 

This is a "standard" HTTP to HTTPS redirect. If this is resulting in a redirect loop (assuming you've discounted your browser cache) then either you have a non-standard server config or you are behind an SSL proxy that manages your security certificate. Either way, you should contact your webhosting provider to clarify.

The redirect loop occurs because... despite the redirect to https://..., the HTTPS server variable is not being updated to indicate this. This suggests that your application server is actually communicating over plain HTTP to some kind of front-end proxy that is handling the SSL connection to the client.

  1. You can try using the HTTPS environment variable (ie. %{ENV:HTTPS}) instead of the HTTPS server variable (ie. %{HTTPS}). This is a reasonably common alternative that some shared hosts use (when no obvious proxy is being used). For example:

    RewriteCond %{ENV:HTTPS} !=on
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=302,NE] 

    (NB: There is no need for the capturing group in the RewriteRule pattern, ie. ^(.*)$ can be simplified to ^ - which is also more efficient as regex go.)

Test with 302 (temporary) redirects to avoid potential caching issues, as 301s are cached persistently by the browser (including any erroneous redirects you might have previously experimented with). You will need to clear your browser cache before testing.


  1. If you are behind a proxy server that is handling the SSL connection then the "standard" way is to check the X-Forwarded-Proto HTTP request header (set by the proxy server as the request passes through), instead of the HTTPS server variable, in your condition. IF you are behind a proxy server then this HTTP request header contains the protocol used to access the proxy, either "http" or "https". However, if you are not behind a proxy server then this header is not set. For example:

    RewriteCond %{HTTP:X-Forwarded-Proto} ^http$
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=302,NE] 

    However, if you are using something like Cloudflare's Flexible SSL option (essentially an SSL proxy) then you should configure page rules in your Cloudflare settings. (Implementing a redirect in .htaccess under this scenario is optional.)

There could be other methods that you would need to use, however, your webhost will need to confirm this.

  • Thanks Mr. White, i was using cloudflare and your answer worked. – Amit May 14 at 2:46
  • this one worked. RewriteCond %{HTTP:X-Forwarded-Proto} ^http$ RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=302,NE] – Amit May 14 at 2:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.