if everything(SERVER AND HOST SETTINGS) is ok just
$conf['https'] = TRUE; in your
According to Enabling HTTP Secure (HTTPS)
Drupal configuration :
If you want to support mixed-mode HTTPS and HTTP sessions open up sites/default/settings.php and add $conf['https'] = TRUE;. This
enables you use the same session over HTTP and HTTPS both -- but with
two cookies where the HTTPS cookie is sent over HTTPS only. You will
need to use contributed modules like securepages to do anything useful
with this mode, like submitting forms over HTTPS and so on. While your
HTTP cookie is still vulnerable to all usual attacks, a hijacked
insecure session cookie can only be used to gain authenticated access
to the HTTP site. It will not be valid on the HTTPS site. Whether this
is a problem or not depends on the needs of your site and the various
module configurations. For example, if all forms are set to go through
HTTPS and your visitors can see the same information as logged in
users then this is not a problem.
For even better security, leave $conf['https'] at the default value (FALSE) and send all authenticated traffic through HTTPS and use
HTTP for anonymous sessions. Once again contributed modules like
Secure Login or 443 Session can help you here. Drupal 7 automatically
enables the session.cookie_secure PHP configuration on HTTPS sites,
which causes SSL-only secure session cookies to be issued to the
For best-possible security, set up your site to only use HTTPS, and respond to all HTTP requests with a redirect to your HTTPS site.
$conf['https'] can be left at its default value (FALSE) on pure-HTTPS
sites. Even then, HTTPS is vulnerable to man-in-the-middle attacks if
the connection starts out as a HTTP connection before being redirected
to HTTPS. Use the HSTS module or set the Strict-Transport-Security
header in your webserver to help prevent users from accessing the site
also you can use Secure Pages module
Description of module :
A small process which will redirect the required pages to a SSL version of the page.
also you can in
$base_url = 'https://'.$_SERVER['SERVER_NAME'];.