Back Back

How to Force HTTPS with the .htaccess File

If you want visitors to always land on the secure version of your site, but the control panel setting doesn’t fit or you use your own rules, you can add the HTTPS redirect directly to the .htaccess file.

What you need before you start

  • A web hosting service running Apache or LiteSpeed.
  • An SSL certificate installed for the domain.
  • File access via the DirectAdmin file manager or an FTP client.

Enabling HTTPS

  1. Make sure you have an SSL certificate

    Without a certificate, redirecting to https:// shows an error. If you don’t have one yet, install it for free: How to install a free SSL certificate.

    Do you really need .htaccess?

    The simplest way is to tick Force SSL with https redirect in the SSL settings. Choose the .htaccess file when you need your own rules, e.g. redirecting with or without www at the same time.

  2. Open the .htaccess file

    The file is in the public_html directory. Choose how to open it:

    In DirectAdmin, go to System Info & Files > File Manager and open the public_html directory.

    The file manager in DirectAdmin.

    .htaccess is a hidden file. If you don’t see it, enable hidden files or create a new file with that name.

  3. Add the redirect rule

    Paste this code at the top of the file:

    RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
    Don’t repeat RewriteEngine On

    If the file already contains RewriteEngine On, paste only the two remaining lines. Two such lines can break all the rules.

    On a WordPress site, paste the rule above the # BEGIN WordPress line, because WordPress rewrites its own section automatically.

  4. Save the file

    Save the changes. The rule takes effect immediately, no server restart needed.

Did it work?

Open your website in a private browser window using http:// at the start. The address should switch to https:// automatically.

If the site doesn’t open, delete the added lines right away and check that the certificate is installed.

FAQ

The browser shows “Too many redirects”

Usually the rule is in the file twice, or you use Cloudflare with Flexible SSL. In Cloudflare, switch to Full (strict) mode and keep only one redirect rule.

I can’t find the .htaccess file

The file name starts with a dot, so it’s treated as hidden. Enable hidden files or simply create a new file named .htaccess.

How do I also redirect the www address?

Add these lines below the main rule. They send visitors from www to the address without www:

RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]
Does this work on LiteSpeed?

Yes. LiteSpeed and OpenLiteSpeed understand the same .htaccess rules as Apache, so the code doesn’t need changing.

The site opens but the browser still says “not secure”

That’s mixed content: the page loads images or scripts over http://. On a WordPress site, change the address to https:// in the settings and update the links in the database.

What’s next

If you run into trouble, contact us via live chat or email.

Web hosting plans All tutorials

Similar articles

Shared Hosting Tutorials