Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

force https on all http pages in .htaccess file

Posted on 2012-04-11
11
Medium Priority
?
996 Views
Last Modified: 2012-04-11
I have the following code in my wordpress .htaccess file:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /dev/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /dev/index.php [L]
</IfModule>

# END WordPress

However, I need to force all of these pages to be over https.  What lines do I add?  So if a user does navigate to any page on my site over port 80, it should automatically serve up that same page but over 443.

Any ideas experts?
0
Comment
Question by:COwebmaster
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
11 Comments
 
LVL 17

Expert Comment

by:Anuroopsundd
ID: 37833536
In case you wish to force HTTPS for a particular folder you can use:

RewriteEngine On RewriteCond %{SERVER_PORT} 80 RewriteCond %{REQUEST_URI} somefolder RewriteRule ^(.*)$ https://www.domain.com/somefolder/$1 [R,L]


http://stackoverflow.com/questions/1108706/correctly-switching-between-http-and-https-using-htaccess


http://www.besthostratings.com/articles/force-ssl-htaccess.html
0
 
LVL 17

Accepted Solution

by:
Anuroopsundd earned 2000 total points
ID: 37833542
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://domain.com/$1 [R,L]

http://davidwalsh.name/force-secure-ssl-htaccess
0
 
LVL 8

Expert Comment

by:X-treem
ID: 37833549
RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
0
Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

 

Author Comment

by:COwebmaster
ID: 37833648
Okay, I tried the following:

RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

However, if type in www.domain.com, it does not redirect to https://www.domain.com

I also tried this:

RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://domain.com/$1 [R,L]

And the page just hangs in the browser.

So, I don't want the user to redirect to any folder or page.  if the user types into the browser to www.domain.com/page-1 or http://www.domain.com/page-1, I want to redirect them to https://www.domain.com/page-1

So whichever page they are on, it converts to https.  Any ideas?
0
 
LVL 17

Expert Comment

by:Anuroopsundd
ID: 37833672
RewriteEngine On
RewriteCond %{SERVER_PORT} !443
RewriteRule (.*) https://www.example.com/[R]
0
 

Author Comment

by:COwebmaster
ID: 37833723
Sorry, that didn't work either.
0
 
LVL 17

Expert Comment

by:Anuroopsundd
ID: 37833731
have you restarted apache after changes?
0
 
LVL 111

Expert Comment

by:Ray Paseur
ID: 37833811
You may be able to do this in PHP, as well.
<?php // RAY_https_only.php
error_reporting(E_ALL);

// DEMONSTRATE HOW TO RESTRICT A SCRIPT SO THAT IT ONLY RUNS BEHIND HTTPS

// IF NOT HTTPS
if (empty($_SERVER["HTTPS"]))
{
    // CONSTRUCT THE HTTPS URL WE WANT, PRESERVING GET VARS
    $my_uri
    = 'https://'
    . $_SERVER["HTTP_HOST"]
    . $_SERVER["REQUEST_URI"]
    ;

    // BAIL OUT WITH 301 AND LOCATION
    header("HTTP/1.1 301 Moved Permanently");
    header("Location: $my_uri");
    exit;
}

// ELSE WE ARE ALREADY IN HTTPS - START SESSION FOR HTTPS ONLY IN ALL SUBDIRECTORIES AND ALL SUBDOMAINS
$x = explode('.', strtolower($_SERVER["HTTP_HOST"]));
$y = count($x);
if ($y == 1) // MAYBE 'localhost'?
{
    $cookie_domain = $x[0];
}
else // SOMETHING LIKE 'www2.atf70.whitehouse.gov'?
{
    // USE THE LAST TWO POSITIONS TO MAKE THE HOST DOMAIN
    $cookie_domain = '.' . $x[$y-2] . '.' . $x[$y-1];
}

$sess_name = session_name();
if (session_start())
{
    // MAN PAGE: http://us2.php.net/manual/en/function.setcookie.php
    setcookie($sess_name, session_id(), NULL, '/', $cookie_domain, TRUE, TRUE);
}

Open in new window

0
 

Author Comment

by:COwebmaster
ID: 37833846
okay, and where would that php page go?

I didn't restart apache.  Do I need to  after making a change to the htaccess file?  So my file is like this:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /dev/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /dev/index.php [L]
RewriteCond %{SERVER_PORT} !443
RewriteRule (.*) https://www.domain.com/dev/ [R]
</IfModule>

Is that correct?
0
 

Author Comment

by:COwebmaster
ID: 37833930
Okay, I got it to work.  I placed the following in my functions.php page:

//force redirect to secure page
if($_SERVER['SERVER_PORT'] != '443') { header('Location: https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']); exit(); }

That forced every page to https.
0
 

Author Closing Comment

by:COwebmaster
ID: 37833940
I got my php solution on David Walsh's site.  Thanks Anuroopsundd!
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction This article is intended for those who are new to PHP error handling (https://www.experts-exchange.com/articles/11769/And-by-the-way-I-am-New-to-PHP.html).  It addresses one of the most common problems that plague beginning PHP develop…
Originally, this post was published on Monitis Blog, you can check it here . In business circles, we sometimes hear that today is the “age of the customer.” And so it is. Thanks to the enormous advances over the past few years in consumer techno…
The purpose of this video is to demonstrate how to manually back up a WordPress Database. This will be demonstrated using a Windows 8 PC. The Host used will be IPage.com Log into your Hosting account. IPage will be used for demonstration : Locat…
The purpose of this video is to demonstrate how to reset a WordPress password if you are locked out and cannot reset the password. A typical use would be if you cannot access the email to which WordPress would send the password recovery email to…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question