4

My Wordpress website is located at example.com/wordpress and I need everything inside to be accessible only using SSL.

I've created a .htaccess rule that redirects http -> https:

RewriteEngine On
RewriteRule ^/?(.*) https://%{SERVER_NAME}/wordpress/directory/$1 [R,L]

After implementing this rule the website is inaccessible as it is stuck in a redirect loop.

What am I doing wrong?

My Wordpress .htaccess:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /wordpress/directory/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /wordpress/directory/index.php [L]
</IfModule>
4

This is a late answer but this works for me:

Change the RewriteCond to this

RewriteCond %{HTTP:X-Forwarded-Proto} !https

Should be like this:

RewriteEngine On 
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://yourdomain.com/$1 [R,L]
  • 1
    This finally worked for me. Can anyone explain why this RewriteCond would work when RewriteCond %{HTTPS} off doesn't? – Peter G Nov 25 '15 at 16:04
  • In some case, If https version of the site is not configured via Apache ModSSL it doesn't set %{HTTPS} variable – Shankar Prakash G Oct 12 '18 at 19:46
2

Without being an htaccess expert, I'd say you're missing a RewriteCond - A condition.

Check if it's on port 80. Try this:

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^/?(.*) https://%{SERVER_NAME}/wordpress/directory/$1 [R,L]

UPDATE:

After seeing your updated question, with the full .htaccess - I'd do this:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /wordpress/directory/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /wordpress/directory/index.php [L]

RewriteCond %{HTTPS} off
RewriteRule ^/?(.*) https://%{SERVER_NAME}/wordpress/directory/$1 [R,L]
</IfModule>

Having your condition and rule underneath Wordpress' standards.

  • Adding it to my .htaccess didn't help, I am experiencing the same redirect loop problem. – SkyHiRider Apr 13 '14 at 22:02
  • Can you copy your htaccess file then? Post it in the question - I'll edit my answer to another attempt then! – Frederik Spang Apr 13 '14 at 22:04
  • Try RewriteCond %{HTTPS} off instead of the server_port condition. – Frederik Spang Apr 13 '14 at 22:06
  • Didn't work and my whole .htaccess file is already in the question :) – SkyHiRider Apr 13 '14 at 22:15
  • Oh.. Where's the standard Wordpress htaccess things then? – Frederik Spang Apr 13 '14 at 22:16
1
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Source https://www.godaddy.com/help/redirect-http-to-https-automatically-8828

0
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

or for just a single page

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteCond %{REQUEST_URI} directory
RewriteRule ^(.*)$ https://www.example.com/directory/$1 [R,L]

or you can add this php to a particular file

if (!isset($_SERVER['HTTPS']) || !$_SERVER['HTTPS']) { // if request is not secure, redirect to secure url
$url = 'https://' . $_SERVER['HTTP_HOST']
. $_SERVER['REQUEST_URI'];

header('Location: ' . $url);
exit;
}

or combine the wordpress rewrite rules with the SSL ones..

RewriteRule ^(.*)$ https://www.example.com/directory/index\.php[R,L]
0

Web sites behind load balancers or reverse proxies that support HTTP_X_FORWARDED_PROTO can be fixed by adding the following code to the wp-config.php file, above the require_once call:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
    $_SERVER['HTTPS'] = 'on';

or by using a plugin

Add into WordPress plugins folder on your website, then activate it in the Plugins admin

<? /* Plugin Name: Set headers */
if (stripos(get_option('siteurl'), 'https://') === 0) {
    $_SERVER['HTTPS'] = 'on';
    // add JavaScript detection of page protocol, and pray!
    add_action('wp_print_scripts', 'force_ssl_url_scheme_script');
}
function force_ssl_url_scheme_script() {
    ?>
    <script>
    if (document.location.protocol != "https:") {
        document.location = document.URL.replace(/^http:/i, "https:");
    }
    </script>
    <?php
}

Source

It is working like

  • http://www.exmaple.com/blog/ to https://www.exmaple.com/blog/
  • http://www.exmaple.com/ to https://www.exmaple.com/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.