Best Practice: 301 Redirect HTTP to HTTPS (Standard Domain)

Question

I have been searching for the perfect 301 redirect. But I am finding so many solutions and do not know what’s best.

Here is what I want to do

Best practice .htacess?

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
</IfModule>

This is my preferred code. At least unil now.

Alternative ways

I also found a lot of other ways to redirect from HTTP to HTTPS. For example:

1.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Missing one step? And no [R=301,L] here?

2.

RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Is a different order generally better?

Should I use

RewriteRule ^(.*)$

instead of

RewriteRule (.*)

?

3.

RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} example\.com$ [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L,NE]

Does using the full domain name have any performance advantages? Do I really need NE? ([R=301,L,NE] vs. [L,R=301])

So, my question to all experts: What's the best (performing) way to redirect both from HTTP to HTTPS and from to HTTPS:// ?

nlu · Accepted Answer · 2017-11-09T14:05:40.057

To start with your favorite solution:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
</IfModule>

In the part handling non-https URLs you are redirecting to %{HTTP_HOST}. Then, in case your host name started with "www", a second redirect has to take place to send you from https://www.domain.tld to https://domain.tld which is supposed to be your final destination.

You can shorten this by using

RewriteRule ^(.*)$ https://domain.tld/%{REQUEST_URI} [L,R=301]

directly in the first rule. The second rule would then only apply to clients, who try to access https://www.domain.tld.

Alternative 1. does not work for the same reason (missing the case that HTTP_HOST could be www.domain.tld) and additionally because of the missing [L,R=301]. This is necessary because you do not just rewrite an URL here, like you could do in other types of rewrite rules. You are requesting the client to change the type of it's request - this is why you are sending him a HTTP code of 301.

Concerning the match part of the RewriteRule itself, you should be consistent: if you want to capture parts of the URI you will use a regular expression with parentheses. As you are in fact using it as a whole here it is fine to just use one of the alternatives for "anything", like ^ and use %{REQUEST_URI} later. If you use some capturing (i.e. (some_regex) you should reference it in the target by using $1 (or whatever you are going to reference) here.

In your 3rd alternative, again www + https is missing.

You can check if https is off or if the domain name contains a leading "www" in one rule, however rewrite conditions are implicitly connected with "and".

So it should read:

RewriteCond %{HTTPS} off          [OR]
RewriteCond %{HTTP_HOST} ^www\.   [NC]
RewriteRule ^ https://domain.tld%{REQUEST_URI} [R=301,L,NE]

The NE is necessary for passing on things like GET-parameters and the like on to the new URI unchanged, see:

http://httpd.apache.org/docs/2.4/rewrite/flags.html

Thanks a lot. I am now using this code: RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://example.com/%{REQUEST_URI} [R=301,L,NE] RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L,NE] — dash, Mar 13 '15 at 19:27
I know that it's a slightly old answer, but wont `RewriteRule ^ https://domain.tld/%{REQUEST_URI} [R=301,L,NE]` from alternative 3 return, e.g. https://domain.tld//index.html with double slashes? Shouldn't the line just read `RewriteRule ^ https://domain.tld/%{REQUEST_URI} [R=301,L,NE]` without the slash between the static domain text and `%{REQUEST_URI}`? — Chri.s, Nov 07 '17 at 08:32
The above code will not work on Network Solutions hosted sites. It will generate an infinite loop. See: http://www.networksolutions.com/support/ssl-redirects/ Which is a poor solution. I'm trying to find an alternative, but, have not yet. — WebDude0482, Mar 08 '18 at 17:10
@WebDude0482 This is a problem specific to networksolutions that should not be addressed here. The documentation of networksolution, you link to, simply states, that they do not allow the server to detect https. If you cannot detect https, you cannot redirect based on it - yes that's obvious. I don't see how the answer should be changed based on this. — nlu, Mar 09 '18 at 13:41
I added it in because people, like me, who come here looking for an answer may be on NS, to which, they don't have to waste their time trying the above. Just trying to help. I'm sure we've all tried code that doesn't work in certain situations and after much time and frustration, find out the hard way. — WebDude0482, Mar 12 '18 at 19:02

score 6 · Answer 2 · answered Mar 31 '17 at 20:02

6

So, condensing, this becomes;

RewriteEngine On 
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC] 
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L,NE]

Let me know if you see any bugs

answered Mar 31 '17 at 20:02

Roel Van de Paar

2,111
1
24
38

How could we force a trailing slash to all URLs, such as for a WP site if we'd like https://example.com/path to be rewritten as https://example.com/path/ – Mattypants Sep 24 '21 at 19:58
Isn't the L flag supposed to be (L)ast? It ends processing of flags, so NE will be ignored. – Chiwda Oct 15 '21 at 09:26
@Chiwda Interesting! Can you quote a reference/source? – Roel Van de Paar Oct 15 '21 at 22:34
1

https://stackoverflow.com/a/18959763/989468 – Chiwda Oct 18 '21 at 08:37
@Chiwda Thanks. So I wonder how the code by @homesh-paul in comment below works for example where it has the `L` first then the `R=301` ? – Roel Van de Paar Oct 26 '21 at 11:55

score 2 · Answer 3 · answered Aug 16 '19 at 10:46

    RewriteEngine On   
    RewriteCond %{HTTPS} off
    RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
    RewriteCond %{HTTP_HOST} !^www\.
    RewriteRule .* https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Nothing to change just copy and paste.

Best Practice: 301 Redirect HTTP to HTTPS (Standard Domain)

3 Answers3

Linked

Related