Use an HTTPS redirect after the website has a valid certificate and works correctly over HTTPS. On an Apache-compatible hosting service, an .htaccess rule can redirect ordinary HTTP visitors. Prefer a supported control-panel HTTPS option when it already manages the same redirect, so competing rules do not create loops.
IN THIS ARTICLE
01 Before changing the file
Confirm that the site uses Apache or a compatible server that honours .htaccess. Windows IIS uses different configuration. Back up the existing file and identify the document root for the intended website. Review any existing WordPress, application or canonical-domain rules before adding another.
02 Test a temporary redirect
- Open the site directly using HTTPS and verify the certificate, pages and essential forms.
- Edit the .htaccess file in the site's document root. Place the redirect before application routing rules where appropriate.
- Replace the example domain below with the exact preferred hostname for this website.
- Save and test with a temporary 302 response first, using a private browser window or an HTTP response inspection tool.
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://example.com%{REQUEST_URI} [R=302,L]
This example is for a direct HTTPS origin and a single intended site name. It preserves the requested path. A fixed destination avoids constructing the redirect from an unvalidated Host header.
03 Verify before making it permanent
Test the homepage, a nested page and a URL with a query string. Confirm there is a short redirect path, no repeated loop and no certificate warning. When the result is correct, change R=302 to R=301 for a permanent redirect. Browsers can cache permanent redirects, making incorrect rules harder to diagnose.
What changes when HTTPS redirection sits behind a CDN or proxy?
Do not apply this origin-only test blindly when HTTPS terminates at a proxy. The origin may see HTTP even when the visitor used HTTPS. Use the platform's supported proxy and HTTPS configuration, with trusted forwarded headers, rather than trusting arbitrary request headers.
If a loop or server error appears, restore the previous file and investigate the conflicting rule. After redirection works, fix mixed-content links in the application and verify forms and payment callbacks separately.