3

I am trying to make an entire Drupal site https.

I tried enabling secure pages, and this seems to work for every authenticated user.

However any anonymous user either gets only http, or possibly an infinite redirect if I wildcard all possible paths.

How do I get https:// to work on every page, for all users, including anonymous?

This is what my current .htaccess has in the mod_rewrite.c section:

  RewriteEngine on

  # Set "protossl" to "s" if we were accessed via https://.  This is used later
  # if you enable "www." stripping or enforcement, in order to ensure that
  # you don't bounce between http and https.
  RewriteRule ^ - [E=protossl]
  RewriteCond %{HTTPS} on
  RewriteRule ^ - [E=protossl:s]

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Make sure Authorization HTTP header is available to PHP
  # even when running as CGI or FastCGI.
  RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
  • Secure pages is causing the problem. Remove it, and 301 all http to https at the web server level. It's that easy, no other config necessary – Clive Apr 21 '15 at 7:54
  • I removed secure pages and secure login. I've tried a directive in both my .htaccess in the site's webroot as well as a directive in the virtual host. Nothing seems to be working. – Jack Ryan Apr 22 '15 at 16:38
5

It's usually easier to redirect at the Apache level if you're looking to make the entire Drupal HTTPS. You can place this in your .htaccess file:

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
| improve this answer | |
  • That didn't seem to work. I was still able to access http:// – Jack Ryan Apr 21 '15 at 1:59
  • The flag was missing when I pasted the code. It's fixed now. – Shawn Conn Apr 21 '15 at 2:06
  • Nope, still able to access http:// – Jack Ryan Apr 21 '15 at 5:45
  • Have you placed the rule after the <IfModule mod_rewrite.c> & RewriteEngine on sections? Your instance of Apache may not have mod_rewrite on by default. It needs to be enabled for RewriteCond/RewriteRule to work. – Shawn Conn Apr 21 '15 at 5:52
  • Added my .htaccess. – Jack Ryan Apr 22 '15 at 1:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.