.htaccess redirect to https and www
If your site is serving secure pages via the HTTPS protocol (i.e., via SSL/TLS), you may need a technique to redirect all HTTP requests to HTTPS. Then to go further with your canonicalization efforts, you may also want to redirect all www requests to non-www (or vice versa). Both of these techniques are essential for serving canonical versions of your web pages, so why not combine them into single, simple slice of .htaccess? Read on to learn how..
Redirect to https and non-www
To instead redirect all requests to https and non-www, use the following code instead of the previous:
# Canonical HTTPS/non-WWW
<IfModule mod_rewrite.c>
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com [NC]
RewriteRule (.*) https://example.com/$1 [L,R=301]
</IfModule>
As before, place this code in the root .htaccess of your site. Here is what it’s doing:
- Checks if
mod_rewrite
is available - Checks if HTTPS is off, or if the request includes
www
- If either condition matches, the request qualifies and is redirected to the
https/non-www
address
When placed in the root .htaccess, this technique covers all requests, providing complete https/non-www canonicalization for your site. Remember to replace the two instances of example.com
with your own domain name.
Note: if your site is suffering from duplicate pages because of index.php
appended to requested URLs, check out this post at WP-Mix.com that explains how to remove www and index.php from the URL.
Redirect to https and www
The following .htaccess technique redirects qualified requests to the https and www versions of your web pages. Add to your site’s root .htaccess file:
# Canonical https/www
<IfModule mod_rewrite.c>
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule (.*) https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
This code does the following:
- The first two lines conditionally redirect to https. If the
HTTPS
variable is set to off, then the request is redirected to https (see notes below if using a proxy). - The second two lines redirect to www. If the request/host does not begin with
www.
, the request is redirected to www.
When placed in the root .htaccess, this technique covers all requests, providing complete https/www canonicalization for your site. No editing is required with this code; it’s entirely plug-n-play.
Notes if using a proxy
As explained here:
“When behind some forms of proxying, whereby the client is connecting via HTTPS to a proxy, load balancer, Passenger application, etc., the %{HTTPS}
variable may never be on
and cause a rewrite loop. This is because your application is actually receiving plain HTTP traffic even though the client and the proxy/load balancer are using HTTPS. In these cases, check the X-Forwarded-Proto
header instead of the %{HTTPS}
variable.”
So if you are using some sort of proxy service or similar, add the following line to the above code:
RewriteCond %{HTTP:X-Forwarded-Proto} !https
So the final result looks like this if using a proxy server:
# Canonical https/www (when using proxy)
<IfModule mod_rewrite.c>
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule (.*) https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>