Forcing HTTPS means any visitor who types your domain with http:// (or no protocol) is automatically redirected to the secure https:// version. It ensures the padlock appears in all browsers, prevents mixed-content warnings, and satisfies Chrome's increasingly prominent "not secure" label for HTTP pages.
Before Adding the Redirect
Confirm these two things first — skipping them can make your site inaccessible:
- An SSL certificate is installed and working. Open
https://yourdomain.comdirectly in a browser. If the padlock appears and the page loads, you're ready. If you see a certificate error, fix that first. - Your .htaccess file backs up. Download a copy before editing it. A syntax error in .htaccess can bring down the site.
The Redirect Rule
Add this to your .htaccess file, ideally at the top before other rules:
``apache RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] ``
This redirects any HTTP request to the same URL on HTTPS. Use the .htaccess Generator to generate this and other common rules cleanly. For the conceptual background on 301 redirects, see what is a 301 redirect and when to use it.
Testing After Adding the Rule
- Open
http://yourdomain.com(plain HTTP). - Confirm it redirects to
https://yourdomain.com. - Check that the page loads correctly with a padlock.
- Visit a few other pages to confirm the redirect applies everywhere.
Mixed Content: The Next Step
After forcing HTTPS, some pages may show a "mixed content" warning — the page itself is HTTPS, but some resources (images, scripts, embedded content) still have http:// URLs. Fix by:
- Changing
http://tohttps://in the HTML or CMS where these resources are referenced. - Or changing them to
//(protocol-relative), which inherits the page's protocol.
Check your browser's developer console (usually F12 → Console) for "mixed content" errors pointing to the specific resources that need fixing.
If the Site Goes Down After Adding the Rule
Restore the original .htaccess from your backup immediately. Syntax errors in htaccess cause a 500 error. Use the .htaccess Generator to generate clean rules rather than typing them manually, which reduces the chance of syntax errors.
The SEO Signal
Google has used HTTPS as a positive ranking signal since 2014, though it's modest. The more significant ongoing benefit is that Chrome displays a "Not Secure" warning for HTTP pages, which reduces trust and can increase bounce rates. Visitors who see "Not Secure" in the address bar, especially on a form or payment page, frequently leave without completing the action. Forcing HTTPS eliminates this warning permanently. After setup, confirm in Google Search Console that the HTTPS version is set as the preferred domain, and that any canonical tags across the site point to HTTPS URLs rather than HTTP. For the related topic of redirecting old URLs after domain changes, see what is a 301 redirect and when to use it.
