In Drupal 7, I used the Secure login module to run the site on a secure connection, but it seems it doesn't revert back to http on logout. I would like to just run the whole site as https:// as a simplification.

Is there a simple way to do this without the use of module?

  • Today I just installed Htaccess module, changed its existing settings and deployed this profile. Seems to work perfectly... – Aleksey Zubenko Feb 13 '17 at 17:13

Start by reading Enabling HTTP Secure (HTTPS). Please ask more specific questions and/or update your question if that doesn't help.


If you want to redirect all of your pages to be forced to use SSL then add this to your .htaccess file.

# Redirect to HTTPS
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This should be placed directly after RewriteEngine on if you have no previous rewrites.

  • Each time Drupal Core is updated, the .htaccess is recreated so we have to add these lines each time. – Sébastien Gicquel Nov 9 '20 at 21:38

Another handy trick, if you have root access to Apache to alter your vhost directives is to add this to the SSL directive for the site. Most modern browsers obey this directive (IE9 does not)

Header always set Strict-Transport-Security "max-age=63072000"

You can set the age to whatever you want. What this does is inform web browsers that obey this to ONLY use SSL to communicate with your website and never plain HTTP. This adds a little bit of assurance with the whole HTTP/HTTPS switching situation.

It's a handy hack.

NOTE: This will only work if you have a VALID SSL certificate (not self-signed, expired or otherwise incorrect) on your site. If you don't, it will prevent the browser from connecting to it until the max-age period expires.


There is another option you may wish to try—it's what I needed for one of my installs, and it required no additional modules:

First, in your .htaccess:

RewriteCond %{HTTPS} !on
RewriteCond %{HTTP_HOST} ^www\.yourdomainhere\.com*
RewriteRule ^(.*)$ https://www.yourdomainhere.com/ [L,R=301]

This should be added after:

RewriteEngine on

Then, in your settings.php:

$base_url = 'https://www.yourdomainhere.com'; 

Also, you may want to check for external resources, such as Web fonts and other references that need to be coming from an https domain in order to avoid certificate warnings.

Hope this helps.


There's another solution, which is to simply add $_SERVER['HTTPS'] = 'On'; in the settings.php file

See more at https://www.drupal.org/https-information#comment-9901783

It appears however the htaccess method redirects irrespective, whereas the settings.php file requires browser cache to be cleared.

  • 2
    Didnt appaear to do the trick by itself. Had to clear the drupal caches, but then, allthough drupal pages were served as https, resources like images were not. They were loaded, but the browser was warning about it (in the console) and the lock icon had a warning. I had to add the htaccess directive from Ricks answer to get a proper lock icon. – commonpike Jun 21 '15 at 22:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.