.htaccess file not redirecting http://www. to https://www - apache

I have made a .htaccess file to redirect all website traffic to https://www..
This is my complete .htaccess file:
RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.example\.com [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]
The below redirects work exactly as expected:
http://example.com -> https://www.example.com
https://example.com -> https://www.example.com
https://www.example.com -> https://www.example.com
Except:
http://www.example.com -> http://www.example.com
As shown above, if you go to http://www. it doesn't redirect to the HTTPS version.
Can anyone help me understand why the other redirects are working fine, but that one is not?
Additional Notes: I have looked at a number of posts on StackOverflow, but most of their solutions end in redirect loop errors.

After contacting 123-Reg (my hosting provider), they submitted this solution, which works perfectly:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^example.com [NC]
RewriteRule ^(.*)$ http://www.example.com/$1 [L,R=301,NC]
RewriteCond %{ENV:HTTPS} !=on
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]
Basically they have set the script to do two tasks: Change domain to WWW, if it isn't already, THEN change to HTTPS. Also, they used ENV:HTTPS, which is different to what was found in their documentation (ENV:SSL).
Glad to have to this sorted, and maybe this will help out others using 123-Reg Hosting.

RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.example\.com [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]
As you have found, this won't redirect when requesting the canonical hostname (ie. www.example.com) regardless of whether it is HTTP or HTTPS.
You need to change this to something like:
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\.example\.com
RewriteRule (.*) https://www.example.com/$1 [R=301,L]
This will trigger a redirect to the canonical URL if HTTPS is "off" or it's not the canonical hostname.
...but most of their solutions end in redirect loop errors.
If you are behind a proxy (eg. CloudFlare) that is managing your SSL cert then this could still result in a redirect loop because the connection between you and the proxy might be HTTP, not HTTPS. This would mean that your server only serves content over HTTP, not HTTPS. If this is the case then there are additional headers that can be checked on the request (eg. X-Forwarded-Proto) or set a "page rule" in the case of CloudFlare (Flexible SSL - free service).
UPDATE#1: 123-Reg provide a help document regarding SSL. It seems they set an SSL environment variable when "the connection is SSL-secured". This would mean that you could potentially do something like the following instead:
RewriteCond %{ENV:SSL} ^$ [OR]
RewriteCond %{HTTP_HOST} !^www\.example\.com
RewriteRule (.*) https://www.example.com/$1 [R=301,L]
This is, however, non-standard and "unique" to 123-Reg. (Aside: The PHP code suggestion in the 123-Reg linked document is not the recommended way to check the environment variable, as this would result in an E_NOTICE if the variable is not set!?)
You should also ensure your browser cache is cleared before testing.
UPDATE#2: To help with debugging... to find out what values are being returned, you could assign some Apache values to environment variables and check the values of these in your server-side script (eg. PHP?). For example:
RewriteCond %{HTTPS} (.*)
RewriteRule ^ - [E=APACHE_HTTPS:%1]
# You don't really need this, but for completeness...
RewriteCond %{ENV:SSL} (.*)
RewriteRule ^ - [E=APACHE_SSL:%1]
RewriteCond %{HTTP:X-Forwarded-Proto} (.*)
RewriteRule ^ - [E=APACHE_PROTO:%1]
Then check the environment variables APACHE_HTTPS, APACHE_SSL and APACHE_PROTO in your server-side script. (eg. in PHP, use the getenv() function.)

After lots of issues with 123 Reg and redirecting all versions of pages to single relevant https page with Wordpress, this is what has worked for me across multiple sites now and has proven effective in terms of SEO. Hope it helps!
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{ENV:HTTPS} !=on
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Related

htaccess rewrite from http to https

Currently I redirect all http users (www or non-www) of upscfever.com to http://upscfever.com/upsc-fever/index.html
using
RewriteEngine on
RewriteCond %{HTTP_HOST} ^upscfever\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.upscfever\.com$
RewriteRule ^/?$ "http\:\/\/upscfever\.com\/upsc\-fever\/index\.html" [R=301,L]
Now I want all users to shift to https so I modified as follows:
RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} ^upscfever\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.upscfever\.com$
RewriteRule ^/?$ "https\:\/\/upscfever\.com\/upsc\-fever\/index\.html" [R=301,L]
So that all who type upscfever.com OR www.upscfever.com should go to
https://upscfever.com/upsc-fever/index.html - instead
Plus all links should be https. But its not working I get Page not found.
Your server has to setup the https first, depend on hosting vendor, if your hosting is vps you need to setup https for apache, install cert also.
You can find some instruction like this:
https://manual.seafile.com/deploy/https_with_apache.html
https://www.digicert.com/csr-ssl-installation/apache-openssl.htm
I think you want to make 3 different changes:
Change your .htaccess file to redirect requests to root to your custom index irrespective of the HTTPS or HTTP for the original request
RewriteEngine on
RewriteCond %{HTTP_HOST} ^upscfever\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.upscfever\.com$
RewriteRule ^/?$ "https://%{SERVER_NAME}/upsc-fever/index.html" [R,L]
There is no R=301 part here because I'm not sure it is really wise to make permanent such a redirect to an obscure inner URL.
Redirect all other non-HTTPS requests to HTTPS (preserving the rest of the URL):
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} ^upscfever\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.upscfever\.com$
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L]
Making this redirect permanent seems pretty safe.
Change all internal links in all of your HTML pages (or whatever backend generates them) to use protocol-relative // prefix or explicitly https:// instead of current http://. Preserve the protocol for the external links as is.
As for troubleshooting, you may use the Network tab of the Chrome DevTools (F12) to see exact server reply (note: enabling "Preserve log" and "Disable cache" flags is useful in such context)
You can do that using a single rule as follows in your site root .htaccess:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^(?:www\.)?upscfever\.com$ [NC]
RewriteRule ^/?$ /upsc-fever/index.html [R=301,L]
This will redirect both http and https URLs.
You may try something like this:
RewriteEngine On
RewriteCond %{HTTP_HOST} !=""
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteCond %{HTTPS}s ^on(s)|
RewriteRule ^ http%1://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
I hope below code will do the work for you
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://famebooking.net/$1 [R,L]
just simply add above code in .htaccess below authorization header condition is written under RewriteEngine On
Let me know if that helps.

Redirect HTTPS to HTP on Apache

I have an account with a webhost that uses Apache servers. The webhost's file structure uses subfolders for secondary domains of the primary account domain.
What do I need to add to this .htaccess file to redirect if someone types https:mysubdomain in the browser URL. I want to redirect from https to http, ie. http:mysubdomain.
RewriteEngine on
# Use PHP5.4 as default
AddHandler application/x-httpd-php54 .php
RewriteCond %{HTTP_HOST} ^myseconddomain\.myprimarydomain\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.myseconddomain\.myprimarydomain\.com$
RewriteRule ^/?$ "http\:\/\/mysedonddomain\.com" [R=301,L]
Edit Update:
Thank you for suggestions. The approach of modifying the .htaccess file for the subdomain in the subfolder didn't work, even after clearing browser cache. What about modifying the .htaccess for the maindomain. I tried this but it didn't work either. Maybe my syntax?
RewriteEngine on
RewriteCond %{HTTP_HOST} ^https:\/\/myseconddomain.com$
RewriteRule ^www.myseonddomain.com/ [R=301,L]
I have spoken at length with the webhost, Hostmonster, and all they could tell me was that the SSL certificate was working "correctly" - even thought it is associating with unrelated domain names that are not supposed to have any certificate. I guess that is what User82217 was saying, there is no other way than to purchase a wildcard SSL?
Edit Update: I tried putting this in the .htaccess of the maindomain and the seconddomain and nothing works to redirect from https to http when the user types https:// in front of mysecondubdomain.com in the URL
RewriteEngine on
RewriteCond %{HTTPS} =on
RewriteCond %{HTTP_HOST} ^https
RewriteRule ^.*$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Anybody got any more ideas? Thank you.
To force HTTPs to HTTP then you can use the following in your .htaccess file:
#Force HTTP on everything
RewriteCond %{HTTPS} =on
RewriteRule ^.*$ http://%{HTTP_HOST}%{REQUEST_URI} [R,L]
You didn't specifiy if you wanted to remove www or not, but on the assumption that you do, you can also remove that by including the following rule:
RewriteCond %{HTTP_HOST} ^www\. [OR]
Therefore checking if www is in the URL or not, so altogether using:
RewriteCond %{HTTP_HOST} ^www\. [OR]
RewriteCond %{HTTPS} =on
RewriteRule ^.*$ http://%{HTTP_HOST}%{REQUEST_URI} [R,L]
Make sure you clear your cache before testing this.

Simple htaccess mod rewrite

I have multiple domains that end with .nl .com and .de. For each domain name I have a different language. My files are on the .nl domain. What I would like is the following for all domains:
Redirect http://* to https://*
Redirect http://example.* to https://www.example.*
I Have the files on 1 server, and want them to look like it is on 3.
This is what I have on the main server (.NL)
RewriteCond %{HTTP_HOST} !www.example.nl$ [NC]
RewriteRule ^(.*)$ https://www.example.nl/$1 [L,R=301]
And this for the .DE
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://www.example.de/$1 [L,R=301]
RewriteCond %{HTTP_HOST} !www.example.de$ [NC]
RewriteRule ^(.*)$ http://www.example.de/$1 [L,R=301]
RewriteRule ^(.*)$ http://www.example.nl/$1 [P]
And this for the .COM
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://www.example.com/$1 [L,R=301]
RewriteCond %{HTTP_HOST} !www.example.com$ [NC]
RewriteRule ^(.*)$ http://www.example.com/$1 [L,R=301]
RewriteRule ^(.*)$ http://www.example.nl/$1 [P]
I've tried everything, but I could not figure it out.
# This rule will redirect users from their original location, to the same location but using HTTPS.
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://www.example.nl/$1 [R=301,L]
#primary site redirect
RewriteCond %{HTTP_HOST} !^www\.example\.nl [NC]
RewriteRule (.*) https://www.example.nl/$1 [R=301,L]
I believe that's all that's required, as you can see, you first redirect ALL requests that are not https to https example.nl, then you redirect anything that is NOT www.example.nl to https://www.example.nl
If I'm guessing wrong about what you need with [P] you can just replace I think [R=301,L] with [P], though I've never dealt with that configuration so I can't say for sure, but it's easy to test.
https://wiki.apache.org/httpd/RewriteHTTPToHTTPS
this is more or less what we use for https. I think you're getting confused and not realizing that all you need to know is that something is NOT example.nl/$1, there's no need to list all those nots, since all of them are not example.nl/$1
Note the following, which are all NOT the second rule, all will get redirected:
https://example.nl
https://www.example.com
https://example.de
https://www.example.de
Since these are all not:
https://www.example.nl
they get redirected. (.*) means everything, including /.
There's a subtle thing that you need to be aware of with https, you have to have a certificate for ALL versions of all the domains, that's www/non www, or you get those browser alert popups for any initial domain/subdomain that does not have certificate support when the page initially loads. For example, if you don't have a certificate for example.com but you have one for www.example.com if a url comes in: http://example.com you'll get that browser alert, which is very bad for usability and makes it look like it's a scammer site.
I can't remember the exact ordering of processing, but I think that's how it works.

How to stop htaccess rewrite rule updating browser URL

I've read through many of the similar requests such as:
Apache rewrite rule - prevent rewritten URL appearing in browser URL bar
But I can't figure out what I'm doing wrong, any help would be much appreciated.
I'm using codeigniter 3 and it's root is at the following location:
https://example.com/api/v1.0
I've set up a basic route and all is working fine with Codeigniter E.g. If I navigate to:
/api/v1.0/index.php/pages/view/about
the appropriate page appears so all seams well. What I really want is for the URL to get rewritten so that when I enter:
/api/v1.0/pages/view/about
it goes to the same page. I've added a htaccess file that rewrites the rule and all works as expected:
Options +FollowSymlinks
RewriteEngine on
RewriteBase /api/v1.0/
RewriteCond $1 !^(index.php|resources|robots.txt)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [L,QSA]
The problem is, when I enter the the url:
/api/v1.0/pages/view/about
it goes to the correct page, but the browser URL gets updated to:
/api/v1.0/index.php/pages/view/about
My question is, how can I stop the browser URL from being updated?
Update - my web servers site behind an AWS ELB that acts as the https end point. I have the following in the httpd.conf to ensure that any non 'www' prefixed URLS and any http calls are redirected to https://www
<VirtualHost *:80>
RequestHeader set X-Forwarded-Proto "http"
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{REQUEST_URI} !^/_hostmanager/
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteCond %{HTTP_HOST} !^test\. [NC]
RewriteCond %{HTTP_HOST} !^signup\. [NC]
RewriteCond %{REQUEST_URI} !^/_hostmanager/
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</VirtualHost>
I don't think this rule is causing an issue as its not being invoked, I'm providing the correct prefix and protocol.
Many thanks in advance,
Rob
Check that index.php isn't set for $config['index_page'].
If it is change it to:
$config['index_page'] = '';
OK, after much testing it would appear that my virtual host settings in httpd.conf were causing the issue. If I removed these rules and then the local .htaccess rules worked exactly as expected.
I've removed the local .htaccess rules and added the following to rule to httpd.conf:
RewriteRule ^/api/v1\.0/([A-Za-z0-9-/]+)/?$ /api/v1.0/index\.php/$1 [NC,L,QSA] # Process API Call
My Virtual Host section now looks like this:
RequestHeader set X-Forwarded-Proto "http"
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{REQUEST_URI} !^/_hostmanager/
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteCond %{HTTP_HOST} !^test\. [NC]
RewriteCond %{HTTP_HOST} !^signup\. [NC]
RewriteCond %{REQUEST_URI} !^/_hostmanager/
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
RewriteRule ^/api/v1\.0/([A-Za-z0-9-/]+)/?$ /api/v1.0/index\.php/$1 [NC,L,QSA] # Process API Call
So now calls to:
/api/v1.0/some/directory
Will get rewritten to this:
/api/v1.0/index.php/some/directory
And this happens without redirecting the browser or affecting the browser URL. What I don't understand is why this is not entering into an infinite loop as I have no rewrite precondition to check for calls to the /api/v1.0/index.php/*
Anybody know why this is no entering into an infinite loop?

Site keeps redirecting to HTTP when I visit HTTPS, for no apparent reason

I am trying to get SSL working for my site on a LAMP server. When I type any page address on the site as https://www.example.com it gets redirected to http://www.example.com.
I think the SSL would work (or at least I could get it to) if I could get the server to go through HTTPS but it just refuses, and always changes to HTTP. The site utilises Joomla! but I am pretty sure it's not relevant, as:
I have another almost identical Joomla! site on the same server, and SSL works successfully.
SSL certificate has been checked and is valid and installed correctly.
There are no PHP redirects.
There are no .htaccess redirects directly pertaining to HTTP/S, etc.
.htaccess
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule .* index.php [F]
RewriteRule ^order/payment(/?.*)$ /payment [R=301,L]
RewriteRule ^order/complete$ /index.php?option=com_cake&task=orders&id=complete [L]
RewriteRule ^order2$ /index.php?option=com_cake&task=orders&id=index [L]
RewriteRule ^order/2$ /index.php?option=com_cake&task=orders&id=index [L]
RewriteRule ^payment/(.+)$ /index.php?option=com_cake&task=payments&id=$1 [L]
RewriteRule ^admin/(.+)$ /index.php?option=com_cake&task=admin&id=$1 [L]
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_URI} !^/index\.php
RewriteCond %{REQUEST_URI} /component/|(/[^.]*|\.(php|html?|feed|pdf|vcf|raw))$ [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* index.php [L]
So why is the site redirecting? Any ideas?
For anyone who knows Joomla! I tried installing this plugin http://www.yireo.com/software/joomla-extensions/ssl-redirect and tried enabling the 'Secure' option on my home page and it doesn't work. I assume this is because it probably is working but the server is redirecting to HTTP again, for some unknown reason.
The easy way to rule out any Joomla configuration issues is to upload an empty file in to the root directory. Call it ssltest.html, then access that file using https. If it still redirects then you have a server/certificate installation issue and your host needs to check it out.
TRY
RewriteEngine on
Options +FollowSymLinks
# Rewrite to https
RewriteCond %{HTTPS} off
RewriteRule ^(.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L,QSA]
If you have the Joomla Force SSL option in global configuration set and it's not working would you please report it as a bug?