How do I force SSL on Craft?

Question

I've installed a ssl cert on a site and it's working. Now I want to redirect visitors coming in on http over to https

I've put this code and only this code in the htaccess file, but it's causing a redirect loop.

<IfModule mod_rewrite.c>
RewriteEngine On

RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://www.mysite.com/$1 [R,L]

</IfModule>

My original htaccess looked like this:

<IfModule mod_rewrite.c>
RewriteEngine On

RewriteCond %{HTTP_HOST} ^mysite.com [NC]
RewriteRule ^(.*)$ https://www.mysite.com/$1 [L,R=301]

# Send would-be 404 requests to Craft
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
RewriteRule (.+) index.php?p=$1 [QSA,L]
</IfModule>

Could Craft somehow be causing the redirect loop?

In the Craft CP I have the Site URL set to https://www.mysite.com

Answer 1

For reference, this worked:

RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]

Answer 2

I recommend trying out the Patrol plugin. It avoids .htaccess headbanging and just handles the redirects via PHP.

Patrol Plugin for Craft CMS

In the Settings, turn on Secure Connections and add a backslash / to the Protected Areas settings box. That will force SSL across the board. If you want to get more specific, you can provide multiple, more-specific paths.

Answer 3

Try this sample htaccess-file I'm using on another site.

RewriteEngine On
RewriteBase /

# If the request is not secure
RewriteCond %{HTTPS} off
# Redirect to the secure version
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

# Normal redirect rules
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L] 

Answer 4

Because I have so little reputation I cannot comment or like anything.

But @naboovalley 's answer did the trick for me! all the other ones gave me

ERR_TOO_MANY_REDIRECTS!

So the right answer to this question is probably:

RewriteEngine On
RewriteBase /

# If the request is not secure
RewriteCond %{HTTPS} off
# Redirect to the secure version
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

# Normal redirect rules
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L] 

Thank you @naboovalley!

Answer 5

I had to adapt the above slightly to play nicely. Hopefully this saves someone some head banging.

<IfModule mod_rewrite.c>
 RewriteEngine On

 # If the request is not secure
 RewriteCond %{ENV:HTTPS} !=on
 # Redirect to the secure version
 RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

 # Send would-be 404 requests to Craft
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
 RewriteRule (.+) index.php?p=$1 [QSA,L]

</IfModule>