3

I am trying to make an entire Drupal site https.

I tried enabling secure pages, and this seems to work for every authenticated user.

However any anonymous user either gets only http, or possibly an infinite redirect if I wildcard all possible paths.

How do I get https:// to work on every page, for all users, including anonymous?

This is what my current .htaccess has in the mod_rewrite.c section:

  RewriteEngine on

  # Set "protossl" to "s" if we were accessed via https://.  This is used later
  # if you enable "www." stripping or enforcement, in order to ensure that
  # you don't bounce between http and https.
  RewriteRule ^ - [E=protossl]
  RewriteCond %{HTTPS} on
  RewriteRule ^ - [E=protossl:s]

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Make sure Authorization HTTP header is available to PHP
  # even when running as CGI or FastCGI.
  RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
Improve this question
2
  • Secure pages is causing the problem. Remove it, and 301 all http to https at the web server level. It's that easy, no other config necessary
    – Clive ♦
    Commented Apr 21, 2015 at 7:54
  • I removed secure pages and secure login. I've tried a directive in both my .htaccess in the site's webroot as well as a directive in the virtual host. Nothing seems to be working.
    – Jack Ryan
    Commented Apr 22, 2015 at 16:38

1 Answer 1

Reset to default
5

It's usually easier to redirect at the Apache level if you're looking to make the entire Drupal HTTPS. You can place this in your .htaccess file:

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Improve this answer
11
  • That didn't seem to work. I was still able to access http://
    – Jack Ryan
    Commented Apr 21, 2015 at 1:59
  • The flag was missing when I pasted the code. It's fixed now.
    – Shawn Conn
    Commented Apr 21, 2015 at 2:06
  • Nope, still able to access http://
    – Jack Ryan
    Commented Apr 21, 2015 at 5:45
  • Have you placed the rule after the <IfModule mod_rewrite.c> & RewriteEngine on sections? Your instance of Apache may not have mod_rewrite on by default. It needs to be enabled for RewriteCond/RewriteRule to work.
    – Shawn Conn
    Commented Apr 21, 2015 at 5:52
  • Added my .htaccess.
    – Jack Ryan
    Commented Apr 22, 2015 at 1:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.