Securing your website with HTTPS ensures data transmission is encrypted, safeguarding your visitors' information. Even with an SSL certificate installed, traffic may still default to HTTP. Forcing HTTPS redirects all traffic to the secure version of your site, enhancing security and building trust with users. This guide explores methods to force HTTPS on your website, from cPanel settings to .htaccess configurations and WordPress updates.

In this guide

cPanel HTTPS redirect

The simplest way to force HTTPS on your website is through cPanel. Once logged in, navigate to the Domains section. Here, you will find a toggle option labeled Force HTTPS Redirect next to each domain. Enable this toggle to automatically redirect all HTTP traffic to HTTPS. This method is straightforward and does not require any coding knowledge, making it ideal for beginners. By using this feature, you ensure that all incoming requests are securely redirected, leveraging the SSL certificate already installed on your domain.

After enabling the HTTPS redirect, it is important to verify that the redirection is working as expected. Open your website in a browser and check the URL bar for the padlock icon, which indicates a secure connection. Additionally, you can use online tools like SSL Checker to confirm that the SSL certificate is properly configured and that HTTPS is enforced. If you encounter any issues, double-check that the SSL certificate is valid and correctly installed. This method not only enhances security but also improves your site's SEO ranking, as search engines prefer secure sites.

.htaccess redirect

For those comfortable with editing server files, configuring a redirect via the .htaccess file provides more control. Add the following lines of code to your .htaccess file, located in your website's root directory:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This code checks if the connection is not secure and redirects to the HTTPS version of the URL. The R=301 flag indicates a permanent redirect, which is beneficial for SEO.

Ensure your SSL certificate is correctly installed before implementing this redirect to avoid site access issues.

Before editing the .htaccess file, it is advisable to create a backup. This ensures you can restore the original file if something goes wrong. After implementing the changes, test your website thoroughly to ensure all pages redirect correctly and there are no infinite redirect loops. If issues arise, review the .htaccess syntax carefully, as even minor errors can cause significant problems. Consider using online validators to check your configuration. This method provides flexibility, allowing you to customise redirects for specific pages or directories if needed.

WordPress settings

For WordPress sites, forcing HTTPS involves updating the Site URL and WordPress URL settings. Navigate to Settings > General in your WordPress dashboard. Change both the WordPress Address (URL) and Site Address (URL) to begin with https://. Additionally, to secure the admin area, add the following line to your wp-config.php file:

define('FORCE_SSL_ADMIN', true);

This change ensures that all admin sessions occur over HTTPS, enhancing security for your WordPress backend.

It is also beneficial to use plugins like Really Simple SSL, which can automate the process of detecting your settings and configuring your website to run over HTTPS. This plugin helps in fixing mixed content issues and ensures that all URLs in your content are served securely. After making these changes, clear your site's cache to ensure the new settings are applied. Regularly check your site's security using tools like Wordfence to monitor for vulnerabilities and ensure your site remains secure. If you encounter issues, review your theme and plugin settings for any hard-coded URLs that may need updating.

Cloudflare

If you use Cloudflare, you can enforce HTTPS through its dashboard. Log in to your Cloudflare account and navigate to the SSL/TLS section. Set the SSL level to Full (Strict) to ensure that all traffic between Cloudflare and your server is encrypted. Additionally, enable the Always Use HTTPS feature under the Edge Certificates tab. This setting ensures that all HTTP requests are redirected to HTTPS, preventing potential redirect loops.

Cloudflare also offers the Automatic HTTPS Rewrites feature, which helps fix mixed content issues by rewriting HTTP URLs to HTTPS. It is important to regularly check the Analytics section in Cloudflare to monitor the traffic and security events. This helps in identifying any anomalies or attacks on your site. If you experience any issues, review the Cloudflare support documentation or contact their support team for assistance. Ensure your domain's DNS settings are correctly configured to work with Cloudflare, as incorrect settings can lead to downtime or security vulnerabilities.

Fix mixed content

Mixed content occurs when HTTPS pages load resources over HTTP, causing security warnings. To identify mixed content issues, use your browser's console (accessed through Developer Tools) to check for insecure resources. For WordPress sites, the Better Search Replace plugin can help replace HTTP URLs with HTTPS in your database. This tool simplifies the process of updating links and resources, ensuring all content loads securely.

Manually reviewing your site's code is another effective way to identify mixed content. Look for any HTTP links in your HTML, CSS, or JavaScript files and update them to HTTPS. Tools like SSL Labs can provide a comprehensive analysis of your site's SSL configuration and highlight any mixed content issues. Additionally, consider using Content Security Policy (CSP) headers to block mixed content and enforce secure loading of resources. Regularly auditing your site for mixed content, especially after updates or new content additions, ensures ongoing security compliance.

Troubleshooting

Common issues when forcing HTTPS include the ERR_TOO_MANY_REDIRECTS error, which can occur if redirects are improperly configured. Ensure no conflicting redirects exist in your .htaccess file or server settings. If your site is inaccessible, verify that your SSL certificate is valid and correctly installed. If the redirect works only on the homepage, check for hard-coded URLs in your site's content or theme files, as these may need manual updating to HTTPS.

Another frequent issue is the Mixed Content warning, which can be resolved by ensuring all resources are loaded over HTTPS. Use browser developer tools to identify and update any insecure links. If you encounter SSL certificate errors, check the certificate's expiration date and renewal status. Tools like SSL Checker can help diagnose certificate issues. Additionally, review your hosting provider's documentation for specific troubleshooting steps related to SSL and HTTPS. If problems persist, consider reaching out to your hosting provider or a professional web developer for assistance.

Related guides

For more details, refer to MDN HSTS documentation.

For more information on securing your website with SSL, visit our SSL Certificates page. If you encounter any issues, please reach out through our support ticket system.

Was this answer helpful? 0 Users Found This Useful (0 Votes)

Most Popular Articles

How to install and manage SSL certificates

Secure Socket Layer (SSL) certificates are essential for ensuring secure communication between...
How to secure your cPanel hosting account

In the world of shared hosting, security is a shared responsibility. While GHost Cloud ensures a...