如何使用.htaccess和WordPress强制HTTPS

安装SSL证书使您的网站"支持"HTTPS，但它不会"强制"所有人自动使用HTTPS。访问者仍可以通过输入http://或点击旧链接来访问未加密的页面 — 这会同时伤害安全性和SEO，因为Google将其视为一个单独的URL。强制HTTPS将每个HTTP请求重定向到HTTPS，以便您的网站只有一个安全地址。本指南介绍了三种方法，以及需要注意的事项。

方法1：通过.htaccess强制HTTPS（适用于任何虚拟主机）

编辑或在您的public_html文件夹中创建.htaccess文件，并在最开始添加以下行：

RewriteEngine On

RewriteCond %{HTTPS} off

RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

保存文件并通过打开 http://yourdomain.com 进行测试 — 它应该自动重定向到https://。

更多.htaccess模式（代理、端口和www）

上面的基本规则在大多数虚拟主机上都有效，但在位于负载均衡器或反向代理后面的服务器上（如Cloudflare、Nginx代理或AWS ELB），即使访问者通过HTTPS连接，%{HTTPS}变量也总是off — 因为代理内部通过纯HTTP与Apache通信。在这种情况下，改为检查代理附加的X-Forwarded-Proto头：

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

如果需要直接检测端口（某些服务器不公开HTTPS变量），改用端口80条件：

RewriteEngine On
RewriteCond %{SERVER_PORT} ^80$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

要同时强制HTTPS和www/非www偏好，请将规则组合到一个文件中以避免双重重定向（两跳会减慢页面并削弱SEO）。强制非www + HTTPS的示例：

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ https://%1%{REQUEST_URI} [L,R=301]

注意：仅在确认配置正确后才使用R=301（永久），因为浏览器和Google会缓存重定向。在测试期间，首先使用R=302（临时），然后在确信后切换到301。

方法2：在WordPress中强制HTTPS

最快的选项（更改设置URL）：在WordPress管理员 → 设置 → 常规中，将WordPress地址(URL)和网站地址(URL)都从http://更改为https://，然后点击保存更改。WordPress会将您注销，您立即以HTTPS重新登录。这使WordPress自动生成所有内部链接为https。

通过插件（推荐给初学者）：安装Really Simple SSL插件 → 激活 → 点击"激活SSL"。该插件会更新设置URL、启用301重定向，并尝试一步到位修复混合内容 — 如果您不想接触系统文件，这是理想选择。

通过wp-config.php强制管理员/登录区域使用HTTPS：要在登录期间保护您的密码，始终在wp-config.php中的/* That's all, stop editing! */行上方添加此行：

define('FORCE_SSL_ADMIN', true);

这会强制wp-admin和wp-login.php仅通过HTTPS加载，防止cookie和管理员密码被截获。如果您的网站在代理/Cloudflare后面，WordPress仍然循环重定向，请在FORCE_SSL_ADMIN上方添加X-Forwarded-Proto检查：

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])
    && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
    $_SERVER['HTTPS'] = 'on';
}

更改设置URL或移动域名后，使用Better Search Replace插件将数据库中的http://替换为https://，以便所有旧的硬编码图像和链接URL都变成HTTPS。

在Nginx上强制HTTPS(return 301) + HSTS

运行Nginx的网站没有.htaccess文件 — 您在服务器块中配置重定向。正确和最快的方法是一个专门的端口80服务器块，只做重定向，不使用if（Nginx不建议）：

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

然后，在端口443(HTTPS)服务器块中，添加HSTS(Strict-Transport-Security)头，告诉浏览器在下次访问时仅使用HTTPS，无需重定向：

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

始终在重新加载前用nginx -t测试配置，并从小的max-age(如86400 = 1天)开始，一旦HTTPS稳定就增加到一年。HSTS"锁定"浏览器，所以如果SSL稍后中断，访问者在max-age过期前无法访问网站。

强制HTTPS后的常见问题

一旦强制HTTPS生效，两个主要问题会导致网站无法使用：

1. 重定向循环(ERR_TOO_MANY_REDIRECTS)

浏览器无止尽地跳转直到出错。这通常是由Cloudflare SSL模式设置为Flexible引起的 — Cloudflare通过HTTP与源进行通信，但源的.htaccess再次重定向回HTTPS，永远循环。通过将Cloudflare SSL模式设置为Full或Full(Strict)来修复。另一个原因是在多个位置堆叠重定向规则（如.htaccess和WordPress插件同时使用） — 选择其中一个。

2. 混合内容（挂锁带警告）

页面通过HTTPS加载但仍然通过http://拉取一些图像/脚本/CSS，所以浏览器显示部分"不安全"警告。混合内容分为两种：被动(图像、视频)浏览器仍加载但用警告挂锁标记，以及活跃(JavaScript、CSS、iframe)更危险，现代浏览器直接阻止 — 破坏您的布局或功能。如何检测和修复见下一部分。

Method 3: Force HTTPS in DirectAdmin

1. Log in to DirectAdmin
2. Go to SSL Certificates
3. Select your domain
4. Enable Force SSL with https redirect
5. Save

Check for Mixed Content After Forcing HTTPS

Mixed content occurs when an HTTPS page loads some resources (images, scripts) over HTTP. Cleaning it up fully takes a few steps, because http:// can be embedded in several places — the database, the theme, CSS files, and links authors pasted by hand. Work through it like this:

• Open DevTools (F12) → Console: the browser lists exactly which resources loaded over http://, with their URLs. Use that list as your fix-it checklist.
• Use the Better Search Replace plugin to find http://yourdomain.com and replace it with https://yourdomain.com across the whole WordPress database — this fixes many absolute-URL images and internal links at once. Always back up the database first.
• Review your theme and plugins for hardcoded http:// URLs, especially in the header, footer, and widgets that embed external code such as Google Maps, social widgets, or fonts called over http://.
• Fix external resources still on http:// such as a CDN, images from other sites, or embeds that don't support HTTPS. If the external source has no HTTPS, host the file on your own server or switch providers.
• Add a Content-Security-Policy with upgrade-insecure-requests as a helper: the header Content-Security-Policy: upgrade-insecure-requests asks the browser to upgrade every request to HTTPS automatically — but use it alongside fixing the source, not instead of it.

Once everything is fixed, do a hard refresh (Ctrl+Shift+R) and confirm the padlock in the URL bar shows no warning — your site is now fully secure.

Frequently Asked Questions

Which of the three methods should I choose?

If you use WordPress, the Really Simple SSL plugin is easiest and safest. If DirectAdmin offers the option, that is convenient too. The .htaccess method suits non-WordPress sites or those wanting manual control — don't combine multiple methods, as that can cause redirect loops.

Does forcing HTTPS affect SEO?

It helps — a 301 redirect consolidates every URL onto a single HTTPS address, so Google doesn't split ranking signals between http and https.

Why is my site unreachable after forcing HTTPS?

Usually it's forcing HTTPS while SSL isn't fully installed. Always confirm https:// works on its own first, and if you use Cloudflare, never set SSL mode to Flexible.

Should I use a 301 or a 302 redirect?

For permanently forcing HTTPS, always use 301 (Moved Permanently) — Google passes link equity from the old URL to the HTTPS one, and browsers cache it, so subsequent loads are faster. Use 302 (temporary) only while testing, because a 302 doesn't pass ranking signals and isn't cached.

What is HSTS and do I need it?

HSTS (HTTP Strict Transport Security) is a header that tells the browser to "remember" that this site must be accessed over HTTPS only, so the next visit skips HTTP entirely without waiting for a redirect — improving both security and speed. It isn't mandatory, but it's recommended once HTTPS is stable, and you should start with a small max-age first.

Will my old links in Google break after forcing HTTPS?

No. With a 301 redirect, Google gradually updates its index from http:// to https:// within a few weeks. Old shared links still work because they're redirected to the HTTPS page automatically. Submitting an HTTPS sitemap in Google Search Console helps speed up re-indexing.