How to redirect HTTP to HTTPS with .htaccess

This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address.

Before you start

Make sure SSL is already active on the domain (it is, by default, through AutoSSL — see what an SSL certificate is) before adding this redirect, or visitors will be sent to a page that doesn't load.

Adding the redirect

1 In cPanel, open File Manager and go into public_html (or the site's folder, if it isn't the main domain).
2 Open the .htaccess file for editing — if there isn't one yet, create it. Make sure hidden files are visible, since it starts with a dot.
3 Add these lines at the very top of the file, above anything already there (such as WordPress's own rules): 
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
4 Save the file and test by visiting the http:// version of your site — it should land on https:// automatically.
Using Cloudflare? If your domain's traffic passes through Cloudflare, set the SSL/TLS mode in the Cloudflare dashboard to Full or Full (strict) before adding this rule. On Flexible mode, Cloudflare talks to this server over plain HTTP, so the server always sees %{HTTPS} off and redirects forever — an endless redirect loop that never finishes loading.

Redirect loop or site not loading after this? We'll take a look.

Open a support ticket

SEE ALSO

Why does my SSL certificate show fewer than 365 days?

How to tell if your site has been compromised

What is an SSL certificate and why does it matter?

Want a paid SSL certificate? See the options.

SSL CERTIFICATES

The padlock your customers look for.

A paid certificate adds warranty and company validation — useful for online shops and any site taking payments or customer data.

See SSL certificates

Hosting already includes free SSL for everyday use

  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and...
Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you — skip to the note below. This is...
How to tell if your site has been compromised Most infections don't announce themselves — they show up as small, odd symptoms before anything looks obviously...
How to clean up a compromised site Cleaning up is only half the job — if the door that let the infection in stays open, it comes back. Work through...
How to activate and install a paid SSL certificate Every domain here already gets a free certificate automatically — see what an SSL certificate is. This page is only...