Right now my domain www.example is setup to force HTTPS and it works. The site also correctly links everything to HTTPS. (there are no occurences of HTTP in the database anywhere).

But if you are visiting a subpage, you can change the url to HTTP again, for example / and it will not enforce HTTPS.

I have this rule in my .htaccess in the root:

RewriteEngine On 
RewriteCond %{HTTP_HOST} ^example [NC]
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ /$1 [R,L]

Any ideas what the cause of this is?

Right now my domain www.example is setup to force HTTPS and it works. The site also correctly links everything to HTTPS. (there are no occurences of HTTP in the database anywhere).

But if you are visiting a subpage, you can change the url to HTTP again, for example http://example/subpage/ and it will not enforce HTTPS.

I have this rule in my .htaccess in the root:

RewriteEngine On 
RewriteCond %{HTTP_HOST} ^example [NC]
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://example/$1 [R,L]

Any ideas what the cause of this is?

• htaccess
• ssl
• https

2 Answers 2

To globally redirect all your pages to HTTPS add the following lines to your .htaccess:

# Globally force SSL.
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This should be placed directly after RewriteEngine on if you have no previous rewrites.

Try this htaccess rule

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]