{"id":1053,"date":"2021-05-31T11:39:07","date_gmt":"2021-05-31T08:39:07","guid":{"rendered":"https:\/\/infinitydomainhosting.com\/kb\/?p=1053"},"modified":"2025-09-25T03:56:46","modified_gmt":"2025-09-25T00:56:46","slug":"htaccess-force-https","status":"publish","type":"post","link":"https:\/\/infinitydomainhosting.com\/kb\/htaccess-force-https\/","title":{"rendered":"htaccess force https"},"content":{"rendered":"<h2>\u00a0 \u00a0 \u00a0 htaccess force HTTPS<\/h2>\n<p>So you\u2019ve built your WordPress site you\u2019ve got your SSL certificate, you\u2019ve searched and replaced all of your URLs to sit behind secure HTTPS and when you load your site you see that lovely green padlock in the address bar. So we\u2019re done, right? Well not yet and here\u2019s why.<\/p>\n<p>Let\u2019s open up <a href=\"https:\/\/infinitydomainhosting.com\/kb\/virtualbox-guest-additions\/\">a<\/a> private browsing window to mimic how other users would first visit your site. For Chrome users, this means opening the infamous incognito window now let\u2019s type in your website\u2019s URL without the preceding HTTP (yourdomain.com). What comes up? Well unfortunately the regular unsecured HTTP version of (<a href=\"http:\/\/yourdomain.com\/\" target=\"_blank\" rel=\"noopener\">http:\/\/yourdomain.com<\/a>).<\/p>\n<p>&nbsp;<\/p>\n<p>Without typing https:\/\/ into the browser, which let\u2019s admit no one does, your users and customers will be directed to the insecure version of your site.<\/p>\n<p>SSL Certificates are used to encrypt and protect sensitive data like consumer credit card records and social security details being transmitted throughout the Internet which will give access to only the targeted recipient. When an SSL certificate is used, the data encryptions render the content unreadable to anyone besides the supposed server. It digitally binds a cryptogram key to the data being transmitted. Once the certificate is engaged at the website, it turns on the padlock and the https protocol and permits secure connections from a web server to a browser.<\/p>\n<p>Why would it do such a thing you may ask after I\u2019ve spent all the time to get an SSL certificate and update my URLs? Well, the short answer is the protocols of the internet default to HTTP so you have to force the matter.<\/p>\n<p>&nbsp;<\/p>\n<p>Luckily this is actually really easy to do and there are two routes to accomplish it.<\/p>\n<ul>\n<li><strong>Really Simple SSL<\/strong><\/li>\n<\/ul>\n<p>If you are extremely lazy or don\u2019t want to mess with coding anything anywhere then this first route is for you. All it involves is installing a plugin called <strong><a href=\"https:\/\/wordpress.org\/plugins\/really-simple-ssl\/\" target=\"_blank\" rel=\"noopener\">Really Simple SSL<\/a><\/strong> from the WordPress plugin library. Activating it and pushing the button called Activate SSL for force HTTPS to engage. That\u2019s it you\u2019re done.<\/p>\n<p>Now if we try the same trick to view our site in the private browser you see it goes directly to HTTPS and everyone is happy. So that\u2019s the really easy way to do it, but I\u2019m not a fan of installing plugins if I can accomplish the same goal without it. This route will require a little more experience and higher-level access<\/p>\n<p>&nbsp;<\/p>\n<p>So if you don\u2019t have access to your CPanel account or don\u2019t know what a CPanel account is then stick with the plugin, it gets the job done. In your CPanel account under File Manager in your public_html file, you will find the .htaccess file. If you don\u2019t see it you may have to enable the setting to view hidden files.<\/p>\n<p>&nbsp;<\/p>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone\" src=\"https:\/\/infinitydomainhosting.com\/index.php?rp=\/images\/kb\/8_unhide.jpg\" alt=\"htaccess force https \" width=\"800\" height=\"350\" \/><\/p>\n<p>The .htaccess file is hidden by default. Go ahead and open the file into the editor and at the top above the other rules but below the first declaration insert the following lines of codes.<\/p>\n<p>RewriteEngine On<\/p>\n<p>RewriteCond %{SERVER_PORT} 80<\/p>\n<p>RewriteRule ^(.*)$ https:\/\/www.yourdomain.com\/$1 [R,L]<\/p>\n<p><a href=\"https:\/\/help.dreamhost.com\/hc\/en-us\/articles\/215747758-Force-your-site-to-load-securely-with-an-htaccess-file\" target=\"_blank\" rel=\"noopener\">https:\/\/help.dreamhost.com\/hc\/en-us\/articles\/215747758-Force-your-site-to-load-securely-with-an-htaccess-file<\/a><\/p>\n<p>&nbsp;<\/p>\n<p>NB: Replace yourdomain.com with your matching domain name<\/p>\n<p>&nbsp;<\/p>\n<p>Save the file and close. And you are done. Adding those rules to the .htaccess force HTTPS\u00a0 is basically what the <a href=\"https:\/\/wordpress.org\/plugins\/really-simple-ssl\/\" target=\"_blank\" rel=\"noopener\">Really Simple SSL<\/a>\u00a0plugin did automatically for you so that you wouldn\u2019t have to venture into this part of your web hosting environment.<\/p>\n<p>Let\u2019s face it most people aren\u2019t willing to mess with stuff back here. I didn\u2019t want to either until I learned my way around better. Anyway, let&#8217;s try our little test again in a private browser window and you\u2019ll be happy to see it goes to HTTPS without a problem. I could explain what each rule does but will discuss that in later tutorials.<\/p>\n<p>Of course, when you\u2019re done make sure to clear your website\u2019s cache. I hope this helps you guys take full advantage of your SSL certificate. If the article has been helpful please like and share it with friends and check our <a href=\"https:\/\/infinitydomainhosting.com\/kb\/\" data-schema-attribute=\"\">knowledgebase<\/a> section for many resources <a href=\"https:\/\/infinitydomainhosting.com\/kb\/\">https:\/\/infinitydomainhosting.com\/kb\/<\/a><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>Other related .htacess articles<\/p>\n<p>htaccess redirect 301 |\u00a0htaccess force https |\u00a0htaccess for wordpress |\u00a0.htaccess redirect to HTTPS<\/p>\n<p><!--KB_CAT_BLOCK--><\/p>\n<figure class=\"kb-cat-placeholder\" style=\"margin:1.75rem 0;display:block;\">\n<div class=\"kb-cat-wrap\" style=\"position:relative; overflow:hidden; border-radius:12px; box-shadow:0 10px 36px rgba(0,0,0,0.14);\"><img src=\"https:\/\/infinitydomainhosting.com\/kb\/assets\/img\/cat-default.webp\" alt=\"htaccess force https\" loading=\"lazy\" decoding=\"async\" style=\"max-width:100%;height:auto;display:block;border-radius:12px;box-shadow:0 8px 28px rgba(0,0,0,0.12);\" \/><\/p>\n<div class=\"kb-cat-gradient\" style=\"position:absolute; inset:0; background:linear-gradient(180deg, rgba(9,23,60,0.66) 0%, rgba(11,30,70,0.45) 40%, rgba(11,30,70,0.15) 100%);\"><\/div>\n<div class=\"kb-cat-textbox\" style=\"position:absolute; inset:auto 5% 7% 5%; color:#fff; text-align:center; display:flex; flex-direction:column; gap:.4rem; align-items:center; justify-content:flex-end;\">\n<div class=\"kb-cat-title\" style=\"font-weight:800; font-size:clamp(20px,3.6vw,34px); line-height:1.2; letter-spacing:.2px; text-shadow:0 1px 2px rgba(0,0,0,.35);\">Force HTTPS\u00a0 basically redirects the insecure version 2 HTTPS<\/div>\n<div class=\"kb-cat-meta\" style=\"opacity:1; font-weight:600; font-size:clamp(13px,2.6vw,16px); line-height:1.45; text-shadow:0 1px 2px rgba(0,0,0,.28);\">force HTTPS\u00a0 basically redirects automatically the insecure version(HTTP) of your site to the secure sockets (HTTPS)<\/div>\n<div class=\"kb-cat-desc\" style=\"opacity:1; font-weight:500; font-size:clamp(12px,2.4vw,15px); line-height:1.5; max-width:900px; text-wrap:balance; text-shadow:0 1px 2px rgba(0,0,0,.25);\">General<\/div>\n<\/div>\n<\/div>\n<\/figure>\n","protected":false},"excerpt":{"rendered":"<p>\u00a0 \u00a0 \u00a0 htaccess force HTTPS So you\u2019ve built your WordPress site you\u2019ve got your SSL certificate, you\u2019ve searched and replaced all&hellip;<\/p>\n","protected":false},"author":1,"featured_media":1458,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_lmt_disableupdate":"","_lmt_disable":"","footnotes":""},"categories":[4,1,3,12,47,8,2],"tags":[79,54,53,70,78],"class_list":["post-1053","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ssl-certificates","category-general","category-php-scripts","category-tips_tricks","category-website","category-website-security","category-wordpress","tag-htaccess","tag-htaccess-for-wordpress","tag-htaccess-force-https","tag-php","tag-ssl"],"_links":{"self":[{"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/posts\/1053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/comments?post=1053"}],"version-history":[{"count":21,"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/posts\/1053\/revisions"}],"predecessor-version":[{"id":48478,"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/posts\/1053\/revisions\/48478"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/media\/1458"}],"wp:attachment":[{"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/media?parent=1053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/categories?post=1053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infinitydomainhosting.com\/kb\/wp-json\/wp\/v2\/tags?post=1053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}