I'm using HTACCESS to force all my pages to redirect to the HTTPS version. However the home page is still able to go to the HTTP version.

I tried 2 examples from this post: How to simply make the whole site HTTPS?

And they work, but not for my home page as I mentioned. HTTPS is redirecting everywhere except the home page.

RewriteCond %{HTTPS} !on
RewriteCond %{HTTP_HOST} ^www\.yourdomainhere\.com*
RewriteRule ^(.*)$ https://www.yourdomainhere.com/ [L,R=301]


RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Edit: When I go to the HTTP version of the home page, any time I click a link it redirects to the HTTPS home page instead of the respective link. After that once on the HTTPS home page all links work correctly.

  • @leymannx I actually used those two as examples. And they work, except for the home page as I mentioned. My code is under Rewrite engine on. – paper_robots May 7 '18 at 18:01
  • I see, I see. Thanks for clarification. Have you tried a different browser, too? Is there something special in the Apache config maybe? Are there any other custom rules added in the .htaccess? – leymannx May 7 '18 at 18:15
  • 1
    @leymannx So interesting thing... in safari when going to HTTP. Clicking any link redirects to the HTTPS home page instead of the page it should link to. After that all HTTPS links work correctly. Edit: actually this is happening in all browsers. – paper_robots May 7 '18 at 18:16
  • Please check my answer below. Also note, that I suggested closing this question as off-topic, as it is merely related to webserver configuration and not to Drupal. – Mario Steinitz May 8 '18 at 5:30
  • The first snippet you pasted has a typo on the second line, it should be RewriteCond %{HTTP_HOST} ^www\.yourdomainhere\.com$, notice the $ at the end instead of *. – Елин Й. May 30 '18 at 13:20
    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{HTTPS} off
        RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
    <IfModule mod_headers.c>
        Header always set Strict-Transport-Security "max-age=31536000; $includeSubDomains"

Is what you are looking for. Make sure to place these rules before any other rewriting rules (that may e.g. come from your webserver config).

  • Thanks, I put this at the bottom of my HTACCESS after all the drupal stuff and that seemed to do the trick. – paper_robots May 31 '18 at 15:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.