Forcing HTTPS

When the certificate is active, the site is reachable at both http:// and https://. To give all visitors the secure version, set up a redirect. Before that, make sure the certificate works: SSL certificate and AutoSSL.

Method 1: cPanel#

Method 2: .htaccess#

If you use an application with its own rules, add the rule at the top of the .htaccess file in public_html:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

WordPress#

In WordPress also change the site address in Settings → General (both addresses should start with https://). You can also use WP Toolkit and its address replacement option.

If a redirect loop appears#

The "Too many redirects" error is often caused by duplicate rules or a caching plugin. Remove the duplicate rule, clear the cache and test again.

If images or scripts break after the switch, see Mixed content.