Question posted in
Some documentation to get you started can be found here.

How can I direct all folders on my website to use HTTPS in .htaccess? – Apache

Please be kind, this is my first question on here 🙂

My Setup

Apache served on my Raspberry Pi 4

My .htaccess file

# Force HTTPS on all pages
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

The Problem

Typing in "tyler.cloud" successfully redirects to https://www.tyler.cloud, but typing in "tyler.cloud/react" stays at http://tyler.cloud/react (not HTTPS).

What I’ve tried in addition to above with the same results

RewriteEngine on
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

and

RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

and a few other variations.

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    It turns out "AllowOverride" in /var/www has to be "All" in /etc/apache2/apache2.conf.

    It was set to "None", and that means it ignored all of my .htaccess files.

    I used this:

    RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

    and it seems to work!


  2. 0

    Consider using apache2.conf instead of .htaccess. Because using .htaccess in a server where you have root access is a bad idea. It can slow your website down unnecessarily.

    Try using this instead of .htaccess:

    <Directory "/path/to/web/directory">
RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</Directory>

    And if you are using VirtualHosts, add:

    RewriteEngine On
RewriteOptions Inherit

    inside the virtualhost.

    And also, if someone points their domain to your IP address, then they will be able to show your website through their IP address (unless you are using Name based virtual hosting i.e. https://httpd.apache.org/docs/2.4/vhosts/name-based.html, but still they will be able to access your main Apache host with the IP address of course). Although because you are using HTTPS, their domain probably will fail HTTPS. But, because you do not have HSTS (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) set up, users can still access the website.

    So, I would also suggest you to redirect to your domain if the domain doesn’t match https://www.tyler.cloud, using the following: (add the following to inside <Directory> directive)

    (If you are planning to add HSTS preload see the next solution please)

    #Do not use RewriteEngine On more than once. see the next solution if you are planning to use HSTS preload
RewriteCond %{HTTP_HOST} !^www.tyler.cloud [OR]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://www.tyler.cloud%{REQUEST_URI} [R=301,L]

    Use the next solution if planning to use HSTS preload:

    RewriteCond %{HTTP_HOST} ^tyler.cloud
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://tyler.c%{REQUEST_URI} [R=301,L]

RewriteCond %{HTTP_HOST} !^www.tyler.cloud [OR]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://www.tyler.cloud%{REQUEST_URI} [R=301,L]

    And you are good to go!

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search