Force SSL from .htaccess

August 29, 2018

After converting a non-secure website to use SSL, bookmarked, and cached URLs can still be accessed from user browsers and cause your website to appear broken when the stylesheet does not load in SSL.

Force the website to always load in SSL by placing the following in your .htaccess file.

RewriteCond %{HTTPS} !on           
RewriteRule ^(.*) https://%{SERVER_NAME}/$1 [R,L]

Or like this:

# BEGIN Force HTTPS
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
    RewriteCond %{HTTPS} off [NC]
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
</IfModule>
# END Force HTTPS