htaccess redirect non-www to www with SSL/HTTPS

Question

I want a rewrite rule that redirects everything to https:// AND www.

For example http://example.com should be going to https://www.example.com

This is what I have:

RewriteEngine On
RewriteCond %{SERVER_PORT} !=443
RewriteCond %{HTTP_HOST} ^(www\.)?example\.com$ [NC]
RewriteRule ^(.*)$ "https\:\/\/www\.example\.com\/$1" [R=301,L]

Solution 1

I found the solution.

Without HSTS (single redirect):

RewriteCond %{HTTP_HOST} !^www\.
RewriteRule .* https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

With HSTS (double redirect):

RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule .* https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Solution 2

Your conditions are implicitly AND'd and your second condition will always be true (unless you have other domains), so your current rules will only redirect non-SSL traffic.

You need to OR the conditions and negate the www (second) condition:

RewriteEngine On
RewriteCond %{SERVER_PORT} !=443 [OR]
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]

If the SERVER_PORT is not 443 (ie. is not HTTPS) or the host does not start with www. (ie. you are accessing the bare domain) then redirect to the canonical URL.

However, whether this will redirect https://example.com to https://www.example.com will depend on your security certificate. (Your site needs to be accessible by both www and non-www over SSL for the .htaccess redirect to trigger.)

Solution 3

This will use for both www or non-www If you try to open link with www then url redirect to https with www

Example: http://domain.com redirect to https://domain.com

or If you try to open link with non-www then url redirect to https with non-www

Example: http://www.domain.com redirect to https://www.domain.com

RewriteEngine on

RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Comments

[Fisherino]

You can add this line in htaccess RewriteCond %{HTTP_HOST} !^www\. RewriteRule ^(.*)$ %{HTTP_HOST}/$1 [R=301,L]

[Fisherino]

Replace RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] by RewriteCond %{HTTP_HOST} !^www\. RewriteRule ^(.*)$ %{HTTP_HOST}/$1 [R=301,L]

[MrWhite]

You can edit your answer.

[MrWhite]

Note that this will result in a double redirect when requesting http://example.com (ie. HTTP and non-www), since it will first redirect to HTTPS on the same host (ie. without www) and then redirect to www as a second redirect. You can correct this by simply reversing these two rules.

[xsrf]

@MrWhite @will you actually want a double redirect on a proper https:// redirect, especially if you use HSTS. This way, your HSTS preference can be stored by the browser for both your domains and subsequent requests will always default to https://

[MrWhite]

@xsrf It's still "proper" (and more efficient) to have a single www and HTTPS redirect. It only needs to be kept separate when you are implementing HSTS.

[Will]

Both good points from xsrf and MrWhite. I've updated the answer.

[Will]

@xsrf I checked the double redirect with htaccess.madewithlove.be and it appears it only redirects http:// > https:// not www.

[MrWhite]

@Will The mwl .htaccess tool does not "follow redirects", so does not make a second request in order to see the second redirect. To see the second redirect (in that tool) you need to manually create a second test with the output of the first.