I wanted to allow access to www.mydomain.com/login through ssl only. E.g.: Whenever someone accessed http://www.mydomain.com/login, I wanted him to be redirect to https://www.mydomain.com/login so it's impossible for him/her to access that site without SSL.

I accomplished this by adding the following lines to the virtual host for www.mydomain.com on port 80 in /etc/apache2/sites-available/default:

RewriteEngine   on
RewriteCond     %{SERVER_PORT} ^80$
RewriteRule     ^/login(.*)$ https://%{SERVER_NAME}/login$1 [L,R]
RewriteLog      "/var/log/apache2/rewrite.log"

Now, I want to restrict using SSL for www.mydomain.com. That means, whenever someone accessed https://www.mydomain.com, I want him to be redirected to http://www.mydomain.com (for performance reasons).

I tried this by adding the following lines to the virtual host of www.mydomain.com on port 443 in /etc/apache2/sites-available/default-ssl:

RewriteEngine   on
RewriteCond     %{SERVER_PORT} ^443$
RewriteRule     ^/(.*)$ http://%{SERVER_NAME}/$1 [L,R]
RewriteLog      "/var/log/apache2/rewrite.log"

But when I now try to access www.mydomain.com/login, I get an error message that the server has caused to many redirects. That does make sense. Obviously, the two RewriteRules are playing ping-pong against each other.

How could I work around this?

  • 1
    What amount of performance boost do you expect to get from this? Commented Jan 27, 2012 at 20:01

1 Answer 1


How about:

RewriteCond $1 ^(login) [NC]
RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1

RewriteCond $1 !^(login) [NC]
RewriteRule ^(.*)$ http://%{SERVER_NAME}/$1 [L]

I hope(!) that works - put it in .htacess or, if using vhosts, the first part goes in the normal vhost and the second bit goes in the ssl vhost.

No need to specify 80/443 to pattern match (LOGIN or login) in the URL and force to the SSL (or not if there is no match).

Okay, did not work

Added bit:

 RedirectMatch (?i)\/login https://www.example.com/login

In practice (depends on CMS) all your site links will be http anyway so you should only need the one RedirectMatch.

  • Hm, that didn't do the trick. The first Cond+Rule worked but the 2nd one doesn't work. http://www.mydomain.com/login won't be redirected to https://www.mydomain.com/login
    – Timo Ernst
    Commented Jun 1, 2011 at 14:43
  • Sorry I haven't got a spare SSL site to test with right now. How about RedirectMatch? Just before your existing code for redirecting from https to http, try RedirectMatch - see updated answer... Commented Jun 1, 2011 at 15:02
  • Now, this is strange. I added the RedirectMatch to sites-available/default. When I go to http://www.mydomain.com/login, then I get first redirected to https://www.mydomain.com/login, then it jumps to http://www.mydomain.com//login and displays an error message that to many redirects occured.
    – Timo Ernst
    Commented Jun 1, 2011 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.