Force HTTPS via .htaccess: Apache 2.4 Guide

Updated 7 November 2026 · Standard formula, shown below

This guide shows you how to redirect all HTTP traffic to HTTPS using the .htaccess file on an Apache 2.4 web server. You’ll get a working configuration that forces secure connections, improves SEO, and protects user data. Before starting, ensure you have an SSL certificate installed and that your site loads correctly over HTTPS.

What You’ll Need

Access to your website’s root directory (usually public_html or www) via FTP, cPanel File Manager, or SSH.
An active SSL certificate (free options like Let’s Encrypt are fine).
The ability to edit or create a file named .htaccess (hidden files must be visible in your file manager).
Apache 2.4 with the mod_rewrite module enabled (it is by default on most hosts).

Step-by-Step

Back up your existing .htaccess file. If you already have one, download it and keep a copy. If you don’t, you’ll create a new one.
Locate the .htaccess file. It’s usually in your site’s root directory. If you can’t see it, enable “show hidden files” in your FTP client or file manager.
Open the file in a plain text editor. Use Notepad, Sublime Text, or VS Code. Avoid word processors like Word that add invisible formatting.
Add the rewrite engine line. At the top of the file (or after any existing RewriteEngine lines), add:
```
RewriteEngine On
```
Add the HTTPS redirect rule. Place the following lines after the RewriteEngine On line:
```
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
```
This checks if HTTPS is off, then redirects the current URL to the same URL with HTTPS, using a permanent (301) redirect.
Save the file. Upload it back to the server if you edited it locally.
Test your site. Visit http://yourdomain.com (with the http://) and see if it redirects to https://yourdomain.com. Also test a few internal pages and resources (images, CSS, JS) to ensure they load over HTTPS.
Check for mixed content. Open your browser’s developer tools (F12) and look for any warnings about insecure content. If found, update those URLs to HTTPS in your site’s settings or code.

Common Mistakes

Using the wrong condition. Some outdated guides use RewriteCond %{SERVER_PORT} !^443$. This can fail if your server uses a different port for HTTPS (e.g., 8443). The %{HTTPS} off condition is more reliable.
Placing the rule inside an existing <IfModule mod_rewrite.c> block incorrectly. Ensure the RewriteEngine On is not duplicated, and the rules are inside the block.
Using a 302 redirect instead of 301. A 302 is temporary and will not pass SEO value. Use R=301 for permanent redirects.
Forgetting to update hard-coded URLs. If your theme or plugins reference http:// URLs, you’ll still get mixed content. Update them to https:// or use relative URLs.
Editing the wrong .htaccess. If you have subdirectories with their own .htaccess files, make sure you’re editing the one in the root.

Tips

Use the full rule set for best compatibility. Some hosts require both the %{HTTPS} and %{SERVER_PORT} checks. A robust block looks like:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{SERVER_PORT} !^443
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Add HSTS headers. After forcing HTTPS, you can add the following to your .htaccess to tell browsers to always use HTTPS:
```
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
```
This requires the mod_headers module. Use with caution: once set, browsers will force HTTPS for the duration, so ensure your SSL works perfectly.
Test with a staging site. If possible, test the redirect on a staging copy before applying to production.
Use a plugin or host tool if you’re not comfortable. Many hosting panels (cPanel, Plesk) have a “Force HTTPS” toggle that writes the .htaccess rules for you.

Troubleshooting

Redirect loop (ERR_TOO_MANY_REDIRECTS). This usually means your server is already handling HTTPS in a way that confuses the condition. Try using only the %{HTTPS} off condition, and remove any other redirect rules. Also check if your hosting uses a proxy (like Cloudflare) – you may need to add RewriteCond %{HTTP:X-Forwarded-Proto} !https instead.
500 Internal Server Error. This often indicates a syntax error in .htaccess. Check that you didn’t accidentally add spaces or line breaks in the wrong places. If you can’t access your site, use FTP to rename the .htaccess file to something like .htaccess_backup, then fix and rename back.
Site loads but not with https:// in the address bar. Ensure the rule is in the correct .htaccess and that mod_rewrite is enabled. Also check that your SSL certificate is valid for your domain (including www vs non-www).
Mixed content warnings. This means some resources are still loaded over HTTP. Use a tool like “Why No Padlock” or browser dev tools to find them. Update your WordPress URL settings (Settings > General) to use https, and consider using a “Better Search Replace” plugin to update URLs in the database.
Rule not working on Windows hosting. Some Windows servers (IIS) do not support .htaccess. This guide is for Apache only. If you’re on IIS, you’ll need to use web.config redirects instead.

Frequently Asked Questions

Will this break my existing redirects?

If you have other rewrite rules (e.g., for pretty permalinks), placing the HTTPS rule before them is usually safe. However, test thoroughly. If you use a CMS like WordPress, the .htaccess already contains rules – add your HTTPS rule at the top, after RewriteEngine On.

Do I need to change my WordPress URL settings?

Yes, it’s recommended. Go to Settings > General and update the WordPress Address and Site Address to use https://. This prevents mixed content and ensures links are generated correctly.

Can I force HTTPS on a specific directory only?

Yes. Place the same rules in a .htaccess file inside that directory, or add a RewriteCond to match the directory path. For example, to force HTTPS only for /secure, add RewriteCond %{REQUEST_URI} ^/secure before the rewrite rule.

What is the difference between 301 and 302 redirects?

301 is permanent, 302 is temporary. For forcing HTTPS, use 301 because it tells search engines that the HTTP version is permanently moved to HTTPS, which consolidates SEO ranking.

Will this work with Cloudflare or other CDNs?

Yes, but you may need to adjust the condition. If Cloudflare handles SSL, your server sees HTTP internally. Use RewriteCond %{HTTP:X-Forwarded-Proto} !https instead of %{HTTPS} off. Also set Cloudflare’s SSL mode to “Full (strict)”.

How do I check if mod_rewrite is enabled?

Create a PHP file with <?php phpinfo(); ?> and look for “mod_rewrite” in the loaded modules. Or simply test if your .htaccess rules work – if they don’t, mod_rewrite is likely disabled.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.