2

NEW EDIT 28/oct/19 → I edited the .htaccess file as you said


AddHandler x-mapp-php5.5  .php

# HTTP to HTTPS redirect
RewriteCond %{SERVER_PORT} 80
RewriteRule (.*) https://www.bebechan.net/$1 [R=301,L]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

I also added the lines in wp.config :

/**
 * WordPress Database Table prefix.
 *
 * You can have multiple installations in one database if you give each
 * a unique prefix. Only numbers, letters, and underscores please!
 */
$table_prefix = 'mIQnU';


define('ALLOW_UNFILTERED_UPLOADS', true);
define('FORCE_SSL', true);
define('FORCE_SSL_ADMIN',true);

/* That's all, stop editing! Happy publishing. */

I checked the wp settings and my addresses are well written (https://bebechan.net). I even downloaded a plugin to redirect every http:/bebechan.net/ebook to https://bebechan.net/ebook.

STILL NOT WORKING sadly : (. Every time I go to bebechan.net/ebook, it's not https but http.

Something I wanna point out is that, even when I go directly to the https://bebechan.net/ebook, I can access the 'buy' page, BUT, the little green lock doesn't appear, I checked the 'why no padlock' website (https://www.whynopadlock.com/results/cf25cdd8-0cde-4cfb-bfc6-1dc0ac4e2e12) and it's written that 'You currently have TLSv1 enabled'. Might this be part of the problem? Should I fix it?


BIG EDIT: The host that takes care of my SSL just told me ''The SSL that we provide with your contract only protect one domain OR one subdomain, not both''. They told them then that it's why bebechan.net/ebook wasn't protected but bebechan.net was. But, bebechan.net/ebook isn't a subdomain right? It's still part of my domain bebechan.net? Or am I totally wrong? A bit lost here.

Thanks!

I saw similar questions but they didn't resolve my issue.

I have an active SSL on my WordPress website (hosted by IONOS 1and1). If I enter my example.com it goes to HTTPS. If I enter example.com/smth it goes to HTTP (without s), if I enter www.example.com/smth if goes to HTTPS!

So my wish is to force HTTPS on example.com/smth. I created a .htaccess file through Filezilla entering all the code I could find for example :

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE] 

or

RewriteEngine On 
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L,NE]

I tried it with the wordpress addition:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE] 

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

But nothing seems to redirect! (The page is bebechan.net/ebook). Maybe I've done something wrong creating the .htacces or something?

EDIT: Actually, I just checked right now and it's written that the SSL is provided for clickandbuild/bebechan and I indeed have a clickandbuild folder when I check my FTP (see screenshot below) and there is already a .htaccess there. Maybe that's the issue? Maybe I should edit this one instead of creating a new one in the root?

FTP - Directory Structure

So Actually there is already an .htaccess in the folder .../clickandbuild/bebechan which might be where my SSL is. Looks like there is already a https forced written here. Still not working tho. I'm super lost haha.

Content of the .htaccess:

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE text/cache-manifest
    AddOutputFilterByType DEFLATE text/javascript
    AddOutputFilterByType DEFLATE text/vcard
    AddOutputFilterByType DEFLATE text/vnd.rim.location.xloc
    AddOutputFilterByType DEFLATE text/vtt
    AddOutputFilterByType DEFLATE text/x-component
    AddOutputFilterByType DEFLATE text/x-cross-domain-policy
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE application/ld+json
    AddOutputFilterByType DEFLATE application/atom+xml
    AddOutputFilterByType DEFLATE application/manifest+json
    AddOutputFilterByType DEFLATE application/rdf+xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/schema+json
    AddOutputFilterByType DEFLATE application/vnd.geo+json
    AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
    AddOutputFilterByType DEFLATE application/x-font-ttf
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/x-web-app-manifest+json
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE font/eot
    AddOutputFilterByType DEFLATE font/opentype
    AddOutputFilterByType DEFLATE image/bmp
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE image/vnd.microsoft.icon
    AddOutputFilterByType DEFLATE image/x-icon
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css A2419200
    ExpiresByType text/x-component A2419200
    ExpiresByType application/x-javascript A2419200
    ExpiresByType application/javascript A2419200
    ExpiresByType text/javascript A2419200
    ExpiresByType text/x-js A2419200
    ExpiresByType text/html A3600
    ExpiresByType text/richtext A3600
    ExpiresByType image/svg+xml A3600
    ExpiresByType text/plain A3600
    ExpiresByType text/xsd A3600
    ExpiresByType text/xsl A3600
    ExpiresByType text/xml A3600
    ExpiresByType video/asf A2419200
    ExpiresByType video/avi A2419200
    ExpiresByType image/bmp A2419200
    ExpiresByType application/java A2419200
    ExpiresByType video/divx A2419200
    ExpiresByType application/msword A2419200
    ExpiresByType application/vnd.ms-fontobject A2419200
    ExpiresByType application/x-msdownload A2419200
    ExpiresByType image/gif A2419200
    ExpiresByType application/x-gzip A2419200
    ExpiresByType image/x-icon A2419200
    ExpiresByType image/jpeg A2419200
    ExpiresByType application/json A2419200
    ExpiresByType application/vnd.ms-access A2419200
    ExpiresByType audio/midi A2419200
    ExpiresByType video/quicktime A2419200
    ExpiresByType audio/mpeg A2419200
    ExpiresByType video/mp4 A2419200
    ExpiresByType video/mpeg A2419200
    ExpiresByType application/vnd.ms-project A2419200
    ExpiresByType application/x-font-otf A2419200
    ExpiresByType application/vnd.ms-opentype A2419200
    ExpiresByType application/vnd.oasis.opendocument.database A2419200
    ExpiresByType application/vnd.oasis.opendocument.chart A2419200
    ExpiresByType application/vnd.oasis.opendocument.formula A2419200
    ExpiresByType application/vnd.oasis.opendocument.graphics A2419200
    ExpiresByType application/vnd.oasis.opendocument.presentation A2419200
    ExpiresByType application/vnd.oasis.opendocument.spreadsheet A2419200
    ExpiresByType application/vnd.oasis.opendocument.text A2419200
    ExpiresByType audio/ogg A2419200
    ExpiresByType application/pdf A2419200
    ExpiresByType image/png A2419200
    ExpiresByType application/vnd.ms-powerpoint A2419200
    ExpiresByType audio/x-realaudio A2419200
    ExpiresByType image/svg+xml A2419200
    ExpiresByType application/x-shockwave-flash A2419200
    ExpiresByType application/x-tar A2419200
    ExpiresByType image/tiff A2419200
    ExpiresByType application/x-font-ttf A2419200
    ExpiresByType application/vnd.ms-opentype A2419200
    ExpiresByType audio/wav A2419200
    ExpiresByType audio/wma A2419200
    ExpiresByType application/vnd.ms-write A2419200
    ExpiresByType application/font-woff A2419200
    ExpiresByType application/vnd.ms-excel A2419200
    ExpiresByType application/zip A2419200
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
</IfModule>

AddHandler x-mapp-php5.5  .php

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.bebechan.net/$1 [R,L]
</IfModule> 
  • 1
    "tried it with the wordpress addition" - You appear to be using "pretty permalinks", so presumably if you first tried it without the WP section your site did not function correctly? "creating the .htacces or something" - To clarify, .htaccess should have 2 s at the end. WordPress is installed in the document root and you have no other .htaccess files? Do both example.com and the www subdomain resolve to the same place and serve the same content? – MrWhite Oct 15 at 10:14
  • 1
    You may be working on your site currently, but there appears to be multiple redirects going on? HTTP to HTTPS and back to HTTP(?), with and without the www subdomain. How is your SSL cert managed? Is the cert installed directly on your application server? Or are you using some kind of front-end proxy? Have you configured WordPress itself with the correct www / non-www and HTTP / HTTPS preference? Since WP will also try to redirect the request and your .htaccess could simply be conflicting with this. – MrWhite Oct 15 at 10:28
  • Thanks everyone for your answers. I'm still working on my website right now even If I already put everything online. I am very beginner at this so I'm not sure I can answer well all of your questions. The SSL was provided by my host IONOS 1&1. Actually, I just checked right now and it's written that the SSL is provided for 'clickandbuild/bebechan' and I indeed have a clickandbuild folder when I check my FTP (like here ibb.co/sFjth69) and there is already a .htaccess there. Maybe that's the issue? Maybe I should edit this one instead of creating a new one in the root? – べべちゃんBebechan Oct 16 at 9:00
  • About wordpress, I'm not sure how is it installed and I havent configured wordpress to do anything. Maybe I should? – べべちゃんBebechan Oct 16 at 9:01
  • Here is what's written on the .htaccess in the 'clickandbuild/bebechan' – べべちゃんBebechan Oct 16 at 10:17
2

tl;dr You're HTTP to HTTPS redirect is in the wrong place. It needs to go near the start of the /clickandbuild/bebechan/.htaccess file, not at the end. (See below for further explanation.)


There seems to be a lot of misinformation / confusion here...

The host that takes care of my SSL just told me "The SSL that we provide with your contract only protect one domain OR one subdomain, not both"

That should OK, you only appear to have one domain. However, your SSL cert does need to cover both the domain apex (ie. example.com) and the www subdomain (ie. www.example.com) - it should do - I would be very surprised if it didn't. And by what you stated at the start of the question; it does.

They told them then that it's why bebechan.net/ebook wasn't protected but bebechan.net was.

That's nonsense. The security certificate (SSL cert) protects hostnames, not subdirectories. If example.com is protected then example.com/ebook is also protected, as is example.com/<anything>.

But, bebechan.net/ebook isn't a subdomain right? It's still part of my domain bebechan.net?

Exactly.

I just checked right now and it's written that the SSL is provided for 'clickandbuild/bebechan' and I indeed have a clickandbuild folder when I check my FTP ... and there is already a .htaccess there. Maybe that's the issue? Maybe I should edit this one instead of creating a new one in the root?

It's possible that the document root is set to the directory /clickandbuild/bebechan, but as noted above, SSL certs cover hostnames, not subdirectories.

For the sake of the rest of this answer, I will assume that /clickandbuild/bebechan is actually the document root directory. ie. the directory that is served when you request http://example.com/ (HTTP and HTTPS).

Your FTP screenshot is confusing/ambiguous. If there is a .htaccess file in the /clickandbuild/bebechan subdirectory then presumably that is where WordPress is installed? However, your screenshot appears to show a .htaccess file and WordPress installation in the root directory?! I assume this is above the document root? So, what do these files relate to?

...there is already a .htaccess there. Maybe that's the issue? Maybe I should edit this one instead of creating a new one in the root?

This could very well be the issue. You should not need to manually create the .htaccess file. WordPress will create (and use) one by default - it is necessary to drive the WordPress "pretty" permalinks, which you appear to already be using.

So yes, edit the existing .htaccess file. Do not create another .htaccess file elsewhere.

If you create a .htaccess file in a parent directory (eg. in the root directory from your FTP screenshot - which I assume is where you are creating this .htaccess file?) with a mod_rewrite redirect (which is what this is) then it will likely be overridden by the mod_rewrite directives in the subdirectories .htaccess file and simply be ignored (which appears to be what is happening).

The end of your existing /clickandbuild/bebechan/.htaccess file reads...

:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
</IfModule>

AddHandler x-mapp-php5.5  .php

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.bebechan.net/$1 [R,L]
</IfModule>

The main problem here is that the HTTP to HTTPS redirect is in the wrong place! It should not be at the end of the config file like this. It needs to go near the top of the .htaccess file - importantly, it needs to go before the WordPress front-controller (ie. the code block in the # BEGIN WordPress ... # END WordPress comment markers that currently precedes it).

By placing the redirect at the end, as it appears here then it will not do "much". It will redirect example.com/ (the document root), but not example.com/smth - which is the behaviour you stated initially in your question. However, you also stated that www.example.com/smth IS redirected - that behaviour cannot be explained by this.

In the above .htaccess file, the WordPress front-controller is also unnecessarily repeated - two blocks of code are identical - this is a mistake.

Solution

The end of that .htaccess file should read like the following instead:

:

AddHandler x-mapp-php5.5  .php

# HTTP to HTTPS redirect
RewriteCond %{SERVER_PORT} 80
RewriteRule (.*) https://www.bebechan.net/$1 [R=301,L]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

About wordpress, I'm not sure how is it installed and I havent configured wordpress to do anything. Maybe I should?

Yes, you should. Either using a plugin or manually... you need to ensure that the "WordPress Address (URL)" and "Site Address (URL)" are set correctly (ie. probably to https://www.example.com/). You may need to also set define('FORCE_SSL_ADMIN', true); in the wp-config.php file. There is more information about configuring WordPress elsewhere.

You don't want your .htaccess redirects to conflict with what WordPress thinks your canonical URL should be.

  • How did you get on with this? – MrWhite Oct 20 at 12:22
  • Hi! Thank you so much to take the time to explain clearly everything, It was really useful. It's still not working sadly. I did an update/edit on my post to let you know what I did. – べべちゃんBebechan Oct 28 at 6:30
  • Not sure what I did right, but it's working now and this answer is the best. Thanks! – べべちゃんBebechan Oct 31 at 6:28
0

The following code will redirect all to https://www..... Make sure you are not using any other Wordpress plugin or configuration that could generate a conflict with it.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule .* https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  • Thanks for your answer! Sadly, It is not working: (. I guess I'm doing something wrong. I put this code in an .htaccess file through FTP. Any idea what config could generate a conflict with it? – べべちゃんBebechan Oct 15 at 7:27
  • 1
    This is really no different to the code the OP already presented in their first example. If the OP's code didn't work, then this isn't going to work either. – MrWhite Oct 15 at 9:57
  • 1
    Hi there, as the OP said "entering all the code I could find for example... or ..." I just wanted to provide a functional code, just to make sure he is using a working one. Now we can determine that the problem might be a configuration conflict. – Emirodgar Oct 15 at 10:20
  • Thanks everyone for answering :). What could be the next step? – べべちゃんBebechan Oct 15 at 11:23
0

You must activate the option AllowOverride All to use .htaccess file. Also, you can add the Rewrite rules inside the Directory in the conf file like the below example or on your .htaccess file.

<Directory "/srv/www/htdocs">
Options -Indexes +FollowSymLinks
AllowOverride All
RewriteEngine on
RewriteCond %{SERVER_NAME} =example.com  [OR]
RewriteCond %{SERVER_NAME} =www.example.com 
RewriteRule ^https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
Require all granted
</Directory>

I have changed my Directory in Conf file to only:

 <Directory "/srv/www/htdocs">
  AllowOverride All
  Require all granted
 </Directory> 

And inserted in .htaccess the following only:

RewriteEngine on
RewriteCond %{SERVER_NAME} =www.example.com
RewriteRule ^https://www.example.com%{REQUEST_URI} [END,NE,R=permanent]

So If this don't work contact your host to add AllowOverride All only.

  • 1
    AllowOverride must already be set correctly as they appear to be using WordPress permalinks. – MrWhite Oct 15 at 20:19
  • Add the Rewrite rules only on your htaccess file. The directory part should been set by your host. So test the Rewrite rules if it don't work contact your host to add AllowOverride All to your directories on the http server conf – Talal Al-Khalifa Oct 17 at 10:09
  • 1
    @TalalAl-Khalifa I simply exemplified the domain name (according to RFC2606) and retained the original intent of your code example. Using your own personal domain name in your code example and linking back to your personal website to supposedly "demonstrate" that your arbitrary code snippet works on your server is irrelevant to the question. – MrWhite Oct 19 at 12:46
  • @MrWhite RFC2060 talks about RDNS, what has it to do with this! Demonstration is part of learning, I made it to show that it works, nothing more. And if you see it irrelevant! I don't. I have undone what you did and removed my domain and added example instead and inserted my example domain to the comments. – Talal Al-Khalifa Oct 19 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.