In Drupal 7, I used the Secure login module to run the site on a secure connection, but it seems it doesn't revert back to http on logout. I would like to just run the whole site as https:// as a simplification.

Is there a simple way to do this without the use of module?

  • Today I just installed Htaccess module, changed its existing settings and deployed this profile. Seems to work perfectly... Commented Feb 13, 2017 at 17:13

4 Answers 4


Start by reading Enabling HTTP Secure (HTTPS). Please ask more specific questions and/or update your question if that doesn't help.


If you want to redirect all of your pages to be forced to use SSL then add this to your .htaccess file.

# Redirect to HTTPS
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This should be placed directly after RewriteEngine on if you have no previous rewrites.

  • Each time Drupal Core is updated, the .htaccess is recreated so we have to add these lines each time. Commented Nov 9, 2020 at 21:38
  • 1
    You can add this to composer.json to prevent the overwrite: "extra": { "drupal-scaffold": { "locations": { "web-root": "web/" }, "file-mapping": { "[web-root]/.htaccess": false, } } }
    – zsd
    Commented Dec 6, 2022 at 10:15

Another handy trick, if you have root access to Apache to alter your vhost directives is to add this to the SSL directive for the site. Most modern browsers obey this directive (IE9 does not)

Header always set Strict-Transport-Security "max-age=63072000"

You can set the age to whatever you want. What this does is inform web browsers that obey this to ONLY use SSL to communicate with your website and never plain HTTP. This adds a little bit of assurance with the whole HTTP/HTTPS switching situation.

It's a handy hack.

NOTE: This will only work if you have a VALID SSL certificate (not self-signed, expired or otherwise incorrect) on your site. If you don't, it will prevent the browser from connecting to it until the max-age period expires.


There is another option you may wish to try—it's what I needed for one of my installs, and it required no additional modules:

First, in your .htaccess:

RewriteCond %{HTTPS} !on
RewriteCond %{HTTP_HOST} ^www\.yourdomainhere\.com*
RewriteRule ^(.*)$ https://www.yourdomainhere.com/ [L,R=301]

This should be added after:

RewriteEngine on

Then, in your settings.php:

$base_url = 'https://www.yourdomainhere.com'; 

Also, you may want to check for external resources, such as Web fonts and other references that need to be coming from an https domain in order to avoid certificate warnings.

Hope this helps.

Not the answer you're looking for? Browse other questions tagged or ask your own question.