How to redirect HTTPS to HTTP for some pages using .htaccess

Question

I am facing URL rewriting problem using .htaccess.

I have to redirect all the URLs to HTTPS except 4 URLs. Below is the code in my .htaccess file:

RewriteEngine On
Options +FollowSymlinks
RewriteBase /

RewriteCond %{HTTPS} on
RewriteCond %{HTTP_REFERER} !^https(.*)/(.*)$ [NC]
RewriteCond %{REQUEST_URI} ^/$ [NC]
RewriteCond %{REQUEST_URI} ^/?index\.php$ [NC]
RewriteCond %{REQUEST_URI} ^/?index\.php?view=default [NC]
RewriteCond %{REQUEST_URI} ^/?index\.php?view=news [NC]
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301, NC, L]

# Require SSL on all other pages
RewriteCond %{HTTPS} !on
RewriteRule ^(.*)$ https://%{HTTP_HOST}r%{REQUEST_URI} [R=301, NC, L]

I need to disable HTTPS for following URLs:

1. mydomain.com/
2. mydomain.com/index.php
3. mydomain.com/index.php?view=new
4. mydomain.com/index.php?view=new&abc=xyz&aaa=bbb…
5. mydomain.com/index.php?view=default

For above 5 URLs, I want to redirect in http, but it does not work. It redirects all the URLs to HTTPS only.

Answer 1

The RewriteCond conditions act like an "and", so it's not going to match all 4 file patterns at the same time. One option is separate sets of rules - I like to do that when figuring it out. Another option is to get an "or" pattern working.

The querystring is handled in the RewriteCond, instead of down in the RewriteRule.

I'm not sure what you needed to test on HTTP_REFERER, so I left it out.

This separates out to two rules to keep it simpler. The first does the plain slash or optional index.php with no parameters. The second checks the querystring for view = default or new.

RewriteCond %{HTTPS} on
RewriteCond %{QUERY_STRING} ^$
RewriteCond %{REQUEST_URI} ^/(index\.php)?$ [NC]
RewriteRule .* http://%{HTTP_HOST}%{REQUEST_URI} [R=301, NC]

RewriteCond %{HTTPS} on
RewriteCond %{QUERY_STRING} ^view=(default|new(&.*)?)$ [NC]
RewriteCond %{REQUEST_URI} ^/?index\.php$ [NC]
RewriteRule .* http://%{HTTP_HOST}%{REQUEST_URI} [R=301, NC]

The querystring condition checks for view=default exactly, or view=new or view=new&any=other... The optional &.* means the next thing has to be an ampersand or nothing, which prevents view=new2 from matching by mistake.

Note the user might get a browser warning about redirecting to an "insecure" page, when you redirect them from https to http. Redirect warning isn't a big concern anymore; I just remember it from IE6 days. How to redirect from HTTPS to HTTP without annoying error messages

EDIT: I added a condition to the first rule for an empty querystring. I realized that was matching any querystring without it.

Answer 2

I was also faced that issue and for me this help

RewriteCond %{HTTPS} !^on$
RewriteCond %{REQUEST_URI} ^(/check-out|/payment)$
RewriteRule (.*) https://www.my_site.com/$1 [R,L]

You need to change pages name & your site url.