How to Force HTTPS with .htaccess and WordPress

Installing an SSL certificate makes your site "support" HTTPS, but it does not "force" everyone onto HTTPS automatically. Visitors who type http:// or follow an old link can still reach the unencrypted page — which hurts both security and SEO, because Google treats it as a separate URL. Force HTTPS redirects every HTTP request to HTTPS so your site has one single secure address. This guide covers three ways to do it, plus the precautions.

Method 1: Force HTTPS via .htaccess (Works on Any Hosting)

Edit or create .htaccess in your public_html folder and add these lines at the very top:

RewriteEngine On

RewriteCond %{HTTPS} off

RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Save the file and test by opening http://yourdomain.com — it should redirect to https:// automatically.

More .htaccess Patterns (Proxy, Port, and www)

The basic rule above works on most hosting, but on servers sitting behind a load balancer or reverse proxy (such as Cloudflare, an Nginx proxy, or AWS ELB), the %{HTTPS} variable is always off even when the visitor connects over HTTPS — because the proxy talks to Apache internally over plain HTTP. In that case, check the X-Forwarded-Proto header that the proxy attaches instead:

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

If you need to detect the port directly (some servers don't expose the HTTPS variable), use a port-80 condition instead:

RewriteEngine On
RewriteCond %{SERVER_PORT} ^80$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

To force both HTTPS and a www / non-www preference at once, combine the rules into a single file to avoid a double redirect (two hops slow the page and dilute SEO). Example forcing non-www + HTTPS:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ https://%1%{REQUEST_URI} [L,R=301]

Note: use R=301 (permanent) only once you are sure the configuration is correct, because browsers and Google cache the redirect. While still testing, use R=302 (temporary) first, then switch to 301 when confident.

Method 2: Force HTTPS in WordPress

Quickest option (change the Settings URL): In WordPress Admin → Settings → General, change both WordPress Address (URL) and Site Address (URL) from http:// to https://, then click Save Changes. WordPress logs you out and you log back in over HTTPS immediately. This makes WordPress generate all internal links as https automatically.

Via plugin (recommended for beginners): Install the Really Simple SSL plugin → Activate → click "Activate SSL". The plugin updates the Settings URLs, enables a 301 redirect, and attempts to fix mixed content all in one step — ideal if you'd rather not touch system files.

Force HTTPS for the admin/login area via wp-config.php: To protect your password during login, always add this line to wp-config.php above the /* That's all, stop editing! */ line:

define('FORCE_SSL_ADMIN', true);

This forces wp-admin and wp-login.php to load only over HTTPS, preventing cookie and admin-password interception. If your site is behind a proxy/Cloudflare and WordPress still loops on redirect, add an X-Forwarded-Proto check above FORCE_SSL_ADMIN:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])
    && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
    $_SERVER['HTTPS'] = 'on';
}

After changing the Settings URL or moving the domain, use the Better Search Replace plugin to replace http:// with https:// in the database, so old hardcoded image and link URLs all become HTTPS.

Force HTTPS on Nginx (return 301) + HSTS

Sites running on Nginx have no .htaccess file — you configure the redirect in the server block instead. The correct and fastest approach is a dedicated port-80 server block that does nothing but redirect, with no if (which Nginx discourages):

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

Then, in the port-443 (HTTPS) server block, add the HSTS (Strict-Transport-Security) header to tell the browser to use HTTPS only on the next visit, with no redirect needed:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Always test the config with nginx -t before reloading, and start with a small max-age (e.g. 86400 = 1 day), increasing to a year once HTTPS is stable. HSTS "locks" the browser, so if SSL breaks later, visitors can't reach the site at all until the max-age expires.

Common Problems After Forcing HTTPS

Once forced HTTPS is in place, two main issues can make a site unusable:

1. Redirect Loop (ERR_TOO_MANY_REDIRECTS)

The browser bounces endlessly until it errors. This is usually caused by Cloudflare SSL Mode set to Flexible — Cloudflare talks to the origin over HTTP, but the origin's .htaccess redirects back to HTTPS again, looping forever. Fix it by setting Cloudflare SSL Mode to Full or Full (Strict). Another cause is stacked redirect rules in multiple places (e.g. both .htaccess and a WordPress plugin at once) — pick one.

2. Mixed Content (padlock with a warning)

The page loads over HTTPS but still pulls some images/scripts/CSS over http://, so the browser shows a partial "Not Secure" warning. Mixed content comes in two kinds: passive (images, video) which the browser still loads but flags with a warning padlock, and active (JavaScript, CSS, iframes) which is more dangerous and modern browsers simply block — breaking your layout or features. How to detect and fix it is in the next section.

Method 3: Force HTTPS in DirectAdmin

1. Log in to DirectAdmin
2. Go to SSL Certificates
3. Select your domain
4. Enable Force SSL with https redirect
5. Save

Check for Mixed Content After Forcing HTTPS

Mixed content occurs when an HTTPS page loads some resources (images, scripts) over HTTP. Cleaning it up fully takes a few steps, because http:// can be embedded in several places — the database, the theme, CSS files, and links authors pasted by hand. Work through it like this:

• Open DevTools (F12) → Console: the browser lists exactly which resources loaded over http://, with their URLs. Use that list as your fix-it checklist.
• Use the Better Search Replace plugin to find http://yourdomain.com and replace it with https://yourdomain.com across the whole WordPress database — this fixes many absolute-URL images and internal links at once. Always back up the database first.
• Review your theme and plugins for hardcoded http:// URLs, especially in the header, footer, and widgets that embed external code such as Google Maps, social widgets, or fonts called over http://.
• Fix external resources still on http:// such as a CDN, images from other sites, or embeds that don't support HTTPS. If the external source has no HTTPS, host the file on your own server or switch providers.
• Add a Content-Security-Policy with upgrade-insecure-requests as a helper: the header Content-Security-Policy: upgrade-insecure-requests asks the browser to upgrade every request to HTTPS automatically — but use it alongside fixing the source, not instead of it.

Once everything is fixed, do a hard refresh (Ctrl+Shift+R) and confirm the padlock in the URL bar shows no warning — your site is now fully secure.

Frequently Asked Questions

Which of the three methods should I choose?

If you use WordPress, the Really Simple SSL plugin is easiest and safest. If DirectAdmin offers the option, that is convenient too. The .htaccess method suits non-WordPress sites or those wanting manual control — don't combine multiple methods, as that can cause redirect loops.

Does forcing HTTPS affect SEO?

It helps — a 301 redirect consolidates every URL onto a single HTTPS address, so Google doesn't split ranking signals between http and https.

Why is my site unreachable after forcing HTTPS?

Usually it's forcing HTTPS while SSL isn't fully installed. Always confirm https:// works on its own first, and if you use Cloudflare, never set SSL mode to Flexible.

Should I use a 301 or a 302 redirect?

For permanently forcing HTTPS, always use 301 (Moved Permanently) — Google passes link equity from the old URL to the HTTPS one, and browsers cache it, so subsequent loads are faster. Use 302 (temporary) only while testing, because a 302 doesn't pass ranking signals and isn't cached.

What is HSTS and do I need it?

HSTS (HTTP Strict Transport Security) is a header that tells the browser to "remember" that this site must be accessed over HTTPS only, so the next visit skips HTTP entirely without waiting for a redirect — improving both security and speed. It isn't mandatory, but it's recommended once HTTPS is stable, and you should start with a small max-age first.

Will my old links in Google break after forcing HTTPS?

No. With a 301 redirect, Google gradually updates its index from http:// to https:// within a few weeks. Old shared links still work because they're redirected to the HTTPS page automatically. Submitting an HTTPS sitemap in Google Search Console helps speed up re-indexing.