What is the right way to redirect all traffic to HTTPS?

Question

What I want to do

I manage a website on a hosting service that recently enabled the option to activate a free SSL certificate. I want to redirect all my traffic to the HTTPS version, and make it so that the plain HTTP version won't be available anymore.

What I have tried

I have enabled the SSL certificate on the control panel, and tried to follow the procedure explained by the hosting service, that basically consists in adding some code to the .htaccess file, namely this one:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

My current .htaccess is already populated by the entries by Wordpress itself and a couple of plugins, W3 Total Cache and Wordfence Security (here is a link to pastebin, sorry but I couldn't get it properly formatted here).

I have appended the code from the hosting company to the end of the file, but it didn't work properly and as a result the webpages were badly rendered and the URL itself was modified with random code. I don't know if it was a redirect loop, a conflict with the minification of W3TC, or a combination of both.
What I can guess after a bit of code review is that in the the .htaccess file there are various entries with the <IfModule mod_rewrite.c> condition, that probably generate conflicts.

What I need to know

1. How can I solve this problem with the .htaccess file in order to have a working HTTPS only website?
2. In the Wordpress admin area, in Settings > General, should I change the addresses from http://www.example.com to https://www.example.com? And it should be done before or after modifying .htaccess?
3. Is it necessary to both modify .htaccess and the addresses, or they do the same thing and I should apply only one of these things?

Answer 1

Number 1

If you want your website to be ONLY accessible through HTTPS, you will want to add this piece of code to your .htaccess file, replacing your domain's name:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]
</IfModule>

This will redirect any visits from non-SSL to SSL version of your website.

Number 2

Yes, you need to change the values of your Website Address and Site Address in the admin panel to HTTPS. It is better to do it before editing the .htaccess file, since after editing the .htaccess all traffics will be redirected to HTTPS while your website's URL is in HTTP. Also make sure your scripts, styles and images are accessible over SSL to prevent rendering issues.

Number 3

Yes. The .htaccess will redirect traffic from HTTP to HTTPS, while your Site Address declares that your primary domain is using HTTPS.

If you see any conflicts in the .htaccess file, the best practice is to copy it entirely to pastebin, and update the question with the link. I will try and see if there is a line causing any conflict in your .htaccess file.