Redirecting HTTP to HTTPS automatically

Why is HTTPS Redirect Critical?

When you install an SSL certificate on your server, you've only covered half the journey. If a user enters your site's address with http:// or an old link remains in search engines, the browser initially sends the request on port 80 (HTTP). Without an HTTPS redirect, the user either sees a security error or, at best, insecure content loads for them. This not only harms user experience but also damages your SEO and domain credibility.

An HTTPS redirect means directing all incoming traffic on the HTTP protocol to the secure version (HTTPS). This should be done at the server level to be fast, stable, and independent of application code. In this article, we'll examine two main methods: Apache servers with the .htaccess file and Nginx servers with the config file. We'll also diagnose the most common issue in this process—the redirect loop.

Method One: HTTPS Redirect in Apache with htaccess

If your hosting uses Apache (most shared hosting), the .htaccess file is located in the root of your site's public directory. If this file doesn't exist, create it. Then add the following code at the beginning of the file (after the RewriteEngine On line if it exists):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

What do these three lines do?

• RewriteCond %{HTTPS} off – Activates the condition only for requests that don't have the HTTPS protocol.
• RewriteRule – Takes the requested address and redirects it to the secure version with the same host and path.
• R=301 – Returns the 301 status code (permanent redirect), which is essential for SEO.

If your site runs on a specific domain and you want to redirect only that domain, make the condition more precise:

RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^(www\.)?example\.com$ [NC]
RewriteRule ^(.*)$ https://example.com%{REQUEST_URI} [L,R=301]

Note that in this case, if a user enters with www, they'll be redirected to the non-www version over HTTPS. This helps with domain canonicalization.

Important Note: Order of Rules in htaccess

RewriteRule rules are executed in the order they're written. If there's another rule lower in the file that rewrites URLs, make sure the HTTPS redirect rule comes first. Otherwise, it might render your internal redirects ineffective or create a loop.

Method Two: HTTPS Redirect in Nginx

If you're using Nginx, your site's config file is usually located at /etc/nginx/sites-available/. For the redirect, you need to define a separate server block for port 80 that redirects all requests to port 443. Here's the standard example:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

Place this block before your main HTTPS block. Your main block should look like this:

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    root /var/www/html;
    index index.php index.html;

    # Rest of the site configuration
}

The return 301 directive in Nginx is much more efficient than rewrite and puts less load on the server. If you need more complex logic, you can use rewrite, but for a simple redirect, return is the best choice.

Testing the Nginx Configuration

After making changes, always test the configuration:

sudo nginx -t

If there are no errors, reload the service:

sudo systemctl reload nginx

Common Issue: Redirect Loop

One of the most annoying errors occurs when the browser shows the message "This page isn't working. redirected you too many times" or ERR_TOO_MANY_REDIRECTS. This issue is usually caused by one of the following reasons:

1. Duplicate Redirect in Application Code

If your site is built with WordPress, Laravel, or any other framework and there's also an HTTPS redirect in its code, two redirects might execute back-to-back and create a loop. Solution: have only one redirect layer. If the redirect is done at the server level, check the application code and remove the extra redirect.

2. Incomplete WordPress Settings

In WordPress, if the site address in Settings (General Settings) is still http://, a redirect loop will occur. Go to the dashboard and make sure both the "WordPress Address" and "Site Address" fields start with https://. If you don't have access to the dashboard, add these lines to the wp-config.php file:

define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');

3. Chained Redirects in CDN or Proxy

If you're using Cloudflare or a similar service, make sure the SSL mode in the CDN panel is set to "Full" or "Full (strict)". The "Flexible" mode causes the CDN to communicate with your server over HTTP, and if the server also redirects to HTTPS, a loop is created.

4. Incorrect Rule in htaccess

Some old code uses RewriteCond %{SERVER_PORT} !^443$. If your server is behind a proxy or load balancer, this condition might always be true and create a loop. A more reliable method is using %{HTTPS} off, which works in most environments.

Verification and Troubleshooting Tools

After applying the redirect, be sure to check the result. Here are a few simple methods:

• In your browser, enter http://example.com and see if you're redirected to https://example.com.
• Use an online tool like Redirect Checker to see the redirect chain. If there's more than one consecutive 301 redirect, there's room for optimization.
• Use the curl command in your terminal to check the HTTP headers:

curl -I http://example.com

The output should include the line HTTP/1.1 301 Moved Permanently and the header Location: https://example.com/.

Additional Tips for a Smooth Transition

Updating Internal Links

Server-side redirects only manage incoming traffic. But internal links on your site that are still written with http:// cause extra requests and slowdowns. Update all links in your database or site template to https://. In WordPress, you can use plugins like "Better Search Replace".

Registering the Domain in Google Search Console

After the migration, add the HTTPS version of your site as a new property in Search Console and request re-indexing. This helps Google notice the change faster.

Enabling HSTS

If you want browsers to always automatically use HTTPS, enable the HSTS header. In Nginx:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

In Apache, add this line to your config file or htaccess:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Just note that you should enable HSTS only when you're sure all subdomains also have HTTPS; otherwise, users will no longer have access to the HTTP version of subdomains.

Summary

An HTTPS redirect is an essential action for any site that has installed an SSL certificate. With the two simple methods explained in this article, you can redirect all HTTP traffic to the secure version. The most important point is to test thoroughly after making changes, and if you encounter a redirect loop, first check WordPress settings, then the CDN, and finally the server rules.

If you need help setting up SSL or migrating your site to HTTPS, the ServerNet support team can guide you in choosing and configuring the right service. But remember, regardless of the hosting type, a redirect is a technical task that you can handle yourself with the knowledge from this article.