.htaccess redirect https www made easy

If your site is serving secure pages via the HTTPS protocol (i.e., via SSL/TLS), you may need a technique to redirect all HTTP requests to HTTPS. Then to go further with your canonicalization efforts, you may also want to redirect all www requests to non-www (or vice versa). Both of these techniques are essential for serving canonical versions of your web pages, so why not combine them into single, simple slice of .htaccess? Read on to learn how.

Redirect to https and non-www

To instead redirect all requests to https and non-www, use the following code instead of the previous:

<IfModule mod_rewrite.c>
	RewriteCond %{HTTPS} off [OR]
	RewriteCond %{HTTP_HOST} ^www\.example\.com [NC]
	RewriteRule (.*) https://example.com/$1 [L,R=301]
</IfModule>

As before, place this code in the root .htaccess of your site. Here is what it’s doing:

1. Checks if mod_rewrite is available
2. Checks if HTTPS is off, or if the request includes www
3. If either condition matches, the request qualifies and is redirected to the https/non-www address

When placed in the root .htaccess, this technique covers all requests, providing complete https/non-www canonicalization for your site. Remember to replace the two instances of example.com with your own domain name.

Note: if your site is suffering from duplicate pages because of index.php appended to requested URLs, check out this post at WP-Mix.com that explains how to remove www and index.php from the URL.

Redirect to https and www

The following .htaccess technique redirects qualified requests to the https and www versions of your web pages. Add to your site’s root .htaccess file:

<IfModule mod_rewrite.c>
	RewriteCond %{HTTPS} off
	RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
	
	RewriteCond %{HTTP_HOST} !^www\. [NC]
	RewriteRule (.*) https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

This code does the following:

1. The first two lines conditionally redirect to https. If the HTTPS variable is set to off, then the request is redirected to https (see notes below if using a proxy).
2. The second two lines redirect to www. If the request/host does not begin with www., the request is redirected to www.

When placed in the root .htaccess, this technique covers all requests, providing complete https/www canonicalization for your site. No editing is required with this code; it’s entirely plug-n-play.

Notes if using a proxy

As explained here:

“When behind some forms of proxying, whereby the client is connecting via HTTPS to a proxy, load balancer, Passenger application, etc., the %{HTTPS} variable may never be on and cause a rewrite loop. This is because your application is actually receiving plain HTTP traffic even though the client and the proxy/load balancer are using HTTPS. In these cases, check the X-Forwarded-Proto header instead of the %{HTTPS} variable.”

So if you are using some sort of proxy service or similar, add the following line to the above code:

RewriteCond %{HTTP:X-Forwarded-Proto} !https

So the final result looks like this if using a proxy server:

<IfModule mod_rewrite.c>
	RewriteCond %{HTTP:X-Forwarded-Proto} !https
	RewriteCond %{HTTPS} off
	RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

	RewriteCond %{HTTP_HOST} !^www\. [NC]
	RewriteRule (.*) https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>