5

I want to use SSL (https) for my entire website which is hosted on Arcustech. I came across two instructions, one on Craft's site which discusses forcing SSL on the CP and the other is from Arcustech's site which discusses forcing SSL on entire site. I'm not sure if I can just use the Arcustech's version or if I need a combo because I want the CP to be SSL too.

Here's the code for the two versions:

Craft Forcing SSL on CP (direct link)

<IfModule mod_rewrite.c>
RewriteEngine On

# Force SSL for CP requests
RewriteCond %{HTTP_HOST} example\.com [NC]
RewriteCond %{REQUEST_URI} ^/admin/ [NC]
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [NC,R=301,L]

Arcustech Forcing SSL for entire site

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !^https
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Thank you!

Lori

1
  • I posted my answer below with contains the code that worked on my Arcustech server.
    – Lori
    Jun 16 '15 at 13:20
9

This worked for me on the Arcustech server:

Put this code in the root .htaccess file:

<IfModule mod_rewrite.c>
RewriteEngine On

# Send would-be 404 requests to Craft
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
RewriteRule (.+) index.php?p=$1 [QSA,L]

# SSL only
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !^https
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} 

As RitterKnight mentioned you also need to modify your site's "Site URL" in Settings>General to be https://.

4
  • Good to hear you got it humming! Jun 16 '15 at 18:45
  • The code above does force a redirect to https but with horrible unintended consequences for me. If I type in mydomain.com/news, the resulting redirect URL becomes mydomain.com/index.php?p=news which is awful if i'm trying to use this for 301 redirects. Does anyone know how to fix that?
    – Mike
    Oct 25 '16 at 10:39
  • I'm having the same issue as you Mike. Usually I like to do this manually, but in this case I opted for the patrol plugin
    – Jared
    Oct 26 '16 at 0:37
  • Just noting that issues with the post-redirect URI and query string can be solved by placing the HTTPs (or non-www) redirection rules above Craft's. Thanks to Arcustech support for pointing this out! Feb 23 at 22:21
3

The second one will force SSL no matter which page you're on, including any control panel requests, which is what you're after. As mentioned in the docs, make sure that goes above Craft's default rewrite code.

The only other thing you'll want to do is change the site URL in Craft itself; you can do that in Settings -> General so Craft knows to spit out secure versions of any links or assets in your site, otherwise your visitors be redirecting from non SSL to SSL with every link (which will slow your server down and potentiallly confuse google).

enter image description here

For what it's worth, Arcustech's config didn't work for me, probably difference in server setups since I don't host with them, but I usually use something like:

RewriteEngine On 
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://yoursite.com/$1 [R,L]

That basically means if it's on port 80 (non SSL), redirect to the secure version. Use whichever works for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.