How to redirect your website from http to https

Why you need a redirect

A certificate makes your site work at https://, but it does not switch off the old address with http://. Without a redirect, some visitors (old links, bookmarks, an address typed by hand) still connect without encryption and see a warning next to the address: “Not secure” in Chrome, “Not Secure” in Firefox and Safari. Search engines then see two copies of the same page. A 301 redirect tells browsers and search engines that the site has moved to https:// permanently.

Before you start

• Open https://example.com and https://www.example.com by hand. Both addresses must work without a warning. A redirect to an address with a certificate error will cut the site off for all visitors.
• If your site looks broken or something does not work after switching to https, fix the mixed content first.
• The redirect does not get in the way of verifying the domain with a file for future certificates: Let's Encrypt follows redirects to https.

In your hosting panel

• cPanel: “Domains” → the “Force HTTPS Redirect” toggle next to the domain. It only works for a domain with a valid certificate.
• DirectAdmin: tick “Force SSL with https redirect” on the “SSL Certificates” page or in the domain settings (“Domain Setup”) and save. The option requires “Secure SSL” to be enabled; if it is not there, use the .htaccess file (below).
• Plesk: in the domain's hosting settings (“Hosting Settings”, in the new look “Hosting & DNS” → “Hosting”), in the “Security” section, tick “Permanent SEO-safe 301 redirect from HTTP to HTTPS”. “SSL/TLS support” must be ticked first and a certificate selected. In newer versions of Plesk this redirect is turned on by default for new domains.
• Other panels: look for an option such as “Force HTTPS” or “Redirect to HTTPS” in the domain or SSL settings. If there is none, use the .htaccess file.

The .htaccess file (Apache, most hosting providers)

In your site's folder (where the index file is), open the .htaccess file or create it. Save a copy of the old file first. At the very beginning, add:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

If, after adding them, the page shows an error about too many redirects (in Chrome ERR_TOO_MANY_REDIRECTS, in Firefox “The page isn’t redirecting properly”), remove these lines. This happens, for example, behind Cloudflare in the “Flexible” SSL mode: since your server already has a certificate, switch the SSL/TLS mode in Cloudflare to “Full (strict)”, or remove the rule and turn on the HTTPS redirect in Cloudflare.

Your own server with nginx

Add a separate block for port 80 that redirects everything to https:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

If your configuration already has a block with listen 80 for this domain, replace its contents instead of adding a second one. If the domain has an IPv6 address (AAAA record), also add listen [::]:80;. Check the configuration with sudo nginx -t and reload the server: sudo systemctl reload nginx. The certificate configuration for port 443 is described in the server guide.

WordPress

In “Settings” → “General”, change both addresses (“WordPress Address (URL)” and “Site Address (URL)”) to https://, so that the links on your site point to the https version. Changing the addresses alone does not redirect visits to http://, though: the site will still open there. Turn on the redirect in your hosting panel or in the .htaccess file (above).

Redirect www to non-www

Your site should have one address: with www or without it. Choose one version, e.g. https://example.com, and send the other one to it with a 301 redirect. Search engines then see one site instead of two copies. The certificate must still cover both names, because the browser checks it before it gets the redirect. In the generator, enter both: example.com, www.example.com.

The .htaccess file (Apache)

This code moves visitors from www to the address without www and from http to https in a single redirect. Put it at the top of .htaccess instead of the three lines from the .htaccess section, not next to them, and replace example with your domain (keep the backslashes before the dots):

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

nginx

The port 80 block sends both names straight to the address without www, and a separate block for www on port 443 redirects visits over https:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}
server {
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate     /etc/ssl/yourdomain/fullchain.pem;
    ssl_certificate_key /etc/ssl/yourdomain/privkey.pem;
    return 301 https://example.com$request_uri;
}

In the main block of your site (the one with listen 443 ssl;), keep only example.com in server_name. Then run sudo nginx -t and sudo systemctl reload nginx.

The other way round: non-www to www

If you prefer the address with www, swap the names in .htaccess:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^example\.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

In nginx, do the same: use https://www.example.com$request_uri in both redirect blocks, set the second block to server_name example.com; and keep www.example.com in the main block.

In your hosting panel

Some panels have this option in the domain settings, e.g. Plesk lets you choose the preferred domain (with or without www), and cPanel lets you choose whether a redirect applies to the www address. If your panel has no such option, use the .htaccess file. Check the result the same way as the https redirect (below): curl -I http://www.example.com should show Location: https://example.com/.

Checking

Browsers remember 301 redirects, so test in a private (incognito) window. Type http://example.com (with http) and see whether the address changes to https://. On a computer with a terminal you can also use the command curl -I http://example.com: the response should contain the code 301 and the line Location: https://….