How to force HTTPS on your website

Once your site has an SSL certificate, make sure every visitor uses the secure https:// address. Otherwise people who type your domain, or follow old links, may still land on the insecure http:// version.

Check your SSL first

Your domain must already have a working certificate. In cPanel, open SSL/TLS Status and check for a green padlock. See Your free SSL certificate.

Use one of the methods below, not several. Setting up the same redirect twice can cause a redirect loop.

WordPress

1. Go to Settings → General.
2. Change both WordPress Address (URL) and Site Address (URL) to start with https://.
3. Click Save Changes and log in again.

Most WordPress sites then redirect automatically. If some pages still load over http://, add the .htaccess rule below.

cPanel: Force HTTPS Redirect

1. In cPanel, open Domains.
2. Find your domain and switch Force HTTPS Redirect to On.

This is the simplest option for non-WordPress sites.

.htaccess rule

Add these lines at the top of the .htaccess file in your site’s folder (usually public_html). Use File Manager, and turn on Show Hidden Files to see .htaccess.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Ruachost servers run LiteSpeed, which reads .htaccess rules like Apache does.

Also choose www or non-www

To send everyone to one address, for example https://www.example.com, use this instead (replace example.com with your domain):

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.example.com%{REQUEST_URI} [L,R=301]

Using Cloudflare?

Set Cloudflare’s SSL/TLS mode to Full or Full (strict), not Flexible, before forcing HTTPS here. Flexible mode with a redirect on the server causes an endless loop.

After switching

• Test your site in a private browser window.
• If the padlock is missing or shows a warning, some content is still loading over http://. See Fixing mixed content warnings.
• Optional, for extra security: enable HSTS.