What I want to do

I manage a website on a hosting service that recently enabled the option to activate a free SSL certificate. I want to redirect all my traffic to the HTTPS version, and make it so that the plain HTTP version won't be available anymore.

What I have tried

I have enabled the SSL certificate on the control panel, and tried to follow the procedure explained by the hosting service, that basically consists in adding some code to the .htaccess file, namely this one:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

My current .htaccess is already populated by the entries by Wordpress itself and a couple of plugins, W3 Total Cache and Wordfence Security (here is a link to pastebin, sorry but I couldn't get it properly formatted here).

I have appended the code from the hosting company to the end of the file, but it didn't work properly and as a result the webpages were badly rendered and the URL itself was modified with random code. I don't know if it was a redirect loop, a conflict with the minification of W3TC, or a combination of both.
What I can guess after a bit of code review is that in the the .htaccess file there are various entries with the <IfModule mod_rewrite.c> condition, that probably generate conflicts.

What I need to know

  1. How can I solve this problem with the .htaccess file in order to have a working HTTPS only website?
  2. In the Wordpress admin area, in Settings > General, should I change the addresses from http://www.example.com to https://www.example.com? And it should be done before or after modifying .htaccess?
  3. Is it necessary to both modify .htaccess and the addresses, or they do the same thing and I should apply only one of these things?
  • Have you tried disabling the cache and adding then updating the .htaccess file? your .htaccess already has rules for SSL. The cache may be affecting your HTML output already. – Jack Johansson Feb 9 '17 at 22:25
  • Yes, the file already has some rewrite rules, but I'm non (yet) expert enough to tell which ones affect the secure redirection; could you please point me which lines affect this? Does this mean that I only need to update the URL's in the settings page? – Sekhemty Feb 10 '17 at 9:41
  • Ok, I did some tests: just changing the URLs in the settings page is not sufficient for a proper redirect, the plain HTTP version is still accessible; I've tried to enable the code from your answer while disabling the code from W3TC plugin, and this configuration works; obviously this is not feasible, I still need W3TC to be enabled, but at least now I can determine that this is a conflict with that plugin. – Sekhemty Feb 10 '17 at 10:03
  • I suggest you delete your cache, update the .htaccess and then enable the cache. Try removing the code between lines 163 to 181 in your .htaccess (the code in the pastebin), and see if it works. – Jack Johansson Feb 10 '17 at 11:32

Number 1

If you want your website to be ONLY accessible through HTTPS, you will want to add this piece of code to your .htaccess file, replacing your domain's name:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

This will redirect any visits from non-SSL to SSL version of your website.

Number 2

Yes, you need to change the values of your Website Address and Site Address in the admin panel to HTTPS. It is better to do it before editing the .htaccess file, since after editing the .htaccess all traffics will be redirected to HTTPS while your website's URL is in HTTP. Also make sure your scripts, styles and images are accessible over SSL to prevent rendering issues.

Number 3

Yes. The .htaccess will redirect traffic from HTTP to HTTPS, while your Site Address declares that your primary domain is using HTTPS.

If you see any conflicts in the .htaccess file, the best practice is to copy it entirely to pastebin, and update the question with the link. I will try and see if there is a line causing any conflict in your .htaccess file.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.