force https on all http pages in .htaccess file

In case you wish to force HTTPS for a particular folder you can use:

RewriteEngine On RewriteCond %{SERVER_PORT} 80 RewriteCond %{REQUEST_URI} somefolder RewriteRule ^(.*)$ https://www.domain.com/somefolder/$1 [R,L]


http://stackoverflow.com/questions/1108706/correctly-switching-between-http-and-https-using-htaccess


http://www.besthostratings.com/articles/force-ssl-htaccess.html

RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Okay, I tried the following:

RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

However, if type in www.domain.com, it does not redirect to https://www.domain.com

I also tried this:

RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://domain.com/$1 [R,L]

And the page just hangs in the browser.

So, I don't want the user to redirect to any folder or page.  if the user types into the browser to www.domain.com/page-1 or http://www.domain.com/page-1, I want to redirect them to https://www.domain.com/page-1

So whichever page they are on, it converts to https.  Any ideas?

RewriteEngine On
RewriteCond %{SERVER_PORT} !443
RewriteRule (.*) https://www.example.com/[R]

Sorry, that didn't work either.

have you restarted apache after changes?

You may be able to do this in PHP, as well.

<?php // RAY_https_only.php
error_reporting(E_ALL);

// DEMONSTRATE HOW TO RESTRICT A SCRIPT SO THAT IT ONLY RUNS BEHIND HTTPS

// IF NOT HTTPS
if (empty($_SERVER["HTTPS"]))
{
    // CONSTRUCT THE HTTPS URL WE WANT, PRESERVING GET VARS
    $my_uri
    = 'https://'
    . $_SERVER["HTTP_HOST"]
    . $_SERVER["REQUEST_URI"]
    ;

    // BAIL OUT WITH 301 AND LOCATION
    header("HTTP/1.1 301 Moved Permanently");
    header("Location: $my_uri");
    exit;
}

// ELSE WE ARE ALREADY IN HTTPS - START SESSION FOR HTTPS ONLY IN ALL SUBDIRECTORIES AND ALL SUBDOMAINS
$x = explode('.', strtolower($_SERVER["HTTP_HOST"]));
$y = count($x);
if ($y == 1) // MAYBE 'localhost'?
{
    $cookie_domain = $x[0];
}
else // SOMETHING LIKE 'www2.atf70.whitehouse.gov'?
{
    // USE THE LAST TWO POSITIONS TO MAKE THE HOST DOMAIN
    $cookie_domain = '.' . $x[$y-2] . '.' . $x[$y-1];
}

$sess_name = session_name();
if (session_start())
{
    // MAN PAGE: http://us2.php.net/manual/en/function.setcookie.php
    setcookie($sess_name, session_id(), NULL, '/', $cookie_domain, TRUE, TRUE);
}

Select allOpen in new window

okay, and where would that php page go?

I didn't restart apache.  Do I need to  after making a change to the htaccess file?  So my file is like this:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /dev/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /dev/index.php [L]
RewriteCond %{SERVER_PORT} !443
RewriteRule (.*) https://www.domain.com/dev/ [R]
</IfModule>

Is that correct?

Okay, I got it to work.  I placed the following in my functions.php page:

//force redirect to secure page
if($_SERVER['SERVER_PORT'] != '443') { header('Location: https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']); exit(); }

That forced every page to https.

I got my php solution on David Walsh's site.  Thanks Anuroopsundd!