# Enabling SSL for Drupal

> Serve your Drupal site securely over HTTPS by installing an SSL certificate, adding redirects in .htaccess and testing the setup.

Source: https://helpcenter.ruachost.com/apps/drupal/enabling-ssl-for-drupal/

Securing your Drupal site with **SSL (Secure Sockets Layer)** ensures that all data exchanged between your visitors and your site is encrypted. On **ruachost.com**, you can enable SSL for Drupal using either a purchased certificate or the free **cPanel SSL** option.

## Why Enable SSL?

- Protects sensitive information such as login credentials and payment details.
- Improves visitor trust with the padlock icon in browsers.
- Boosts SEO rankings (Google favors HTTPS sites).
- Prevents “Not Secure” warnings in modern browsers.

## Steps to Enable SSL for Drupal

### Step 1: Install an SSL Certificate

- Purchase an SSL certificate from Ruachost or use the free **cPanel SSL** option.
- Once installed, verify that your domain resolves correctly with `https://`.

### Step 2: Configure `.htaccess` for HTTPS Redirects

1. Log in to your hosting account via **SSH** or use the **File Manager** in cPanel.
2. Open the `.htaccess` file in your Drupal root directory.
3. Add the following directives:

   ```
   RewriteEngine On
   RewriteCond %{HTTP_HOST} !^www\.
   RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

   RewriteCond %{HTTPS} off
   RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
   ```

   - This forces all traffic to use HTTPS.
   - It also ensures visitors are redirected to the **www** version of your domain if required.

### Step 3: Test Your Configuration

- Visit your site using `http://example.com`.
- You should be redirected automatically to `https://www.example.com`.
- Confirm that no browser warnings appear.

### Step 4: Use cPanel SSL with Drupal

- Ruachost provides **cPanel SSL**, a free automated certificate authority recognized by most browsers.
- Certificates are generated automatically for new accounts and can be used immediately.
- This option is ideal for quick and secure deployment.

## Important Notes

- Ensure your SSL certificate matches your domain (with or without `www`).
- If you don’t want to force `www`, remove the first two lines in the `.htaccess` example.
- Always back up your `.htaccess` file before making changes.