<p>I recommend trying out the Patrol plugin.  It avoids .htaccess headbanging and just handles the redirects via PHP.</p>

<p><a href="https://github.com/selvinortiz/craft.patrol">Patrol Plugin for Craft CMS</a></p>

<p>In the Settings, turn on <code>Secure Connections</code> and add a backslash <code>/</code> to the <em>Protected Areas</em> settings box.  That will force SSL across the board.  If you want to get more specific, you can provide multiple, more-specific paths.</p>

CC BY-SA 3.0
2017-02-22T10:36:48.033Z
The settings changed. Now you need to put `'patrol' => ['forceSsl' => true, 'restrictedAreas' => ['/']]` in `craft/config/general.php`
Duncan Lukkenaer
CC BY-SA 3.0
2014-10-14T15:12:53.143Z
2014-10-14T15:12:53.143Z
Ben Parizek
<p>Try this sample htaccess-file I'm using on another site.</p>

<pre><code>RewriteEngine On
RewriteBase /

# If the request is not secure
RewriteCond %{HTTPS} off
# Redirect to the secure version
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

# Normal redirect rules
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L] 
</code></pre>

CC BY-SA 3.0
2014-10-14T13:25:45.803Z
Thanks. Even with just that code in the htaccess, I'm still getting a redirect loop.
user1070143
CC BY-SA 3.0
2014-10-14T13:30:09.953Z
I edited my answer with a complete code. Can you try that one?
naboovalley
CC BY-SA 3.0
2014-10-14T13:16:46.067Z
2014-10-14T13:29:47.653Z
2014-10-14T13:29:47.653Z
naboovalley
<p>I had to adapt the above slightly to play nicely. Hopefully this saves someone some head banging.</p>

<pre><code>&lt;IfModule mod_rewrite.c&gt;
 RewriteEngine On

 # If the request is not secure
 RewriteCond %{ENV:HTTPS} !=on
 # Redirect to the secure version
 RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

 # Send would-be 404 requests to Craft
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
 RewriteRule (.+) index.php?p=$1 [QSA,L]

&lt;/IfModule&gt;
</code></pre>

CC BY-SA 4.0
2019-11-20T17:26:14.537Z
2019-11-20T17:26:14.537Z
sarah3585
<p>Because I have so little reputation I cannot comment or like anything.</p>

<p>But @<a href="https://craftcms.stackexchange.com/a/4129/5557">naboovalley</a> 's answer did the trick for me! all the other ones gave me  </p>

<blockquote>
  <p>ERR_TOO_MANY_REDIRECTS!</p>
</blockquote>

<p>So the right answer to this question is probably:</p>

<pre><code>RewriteEngine On
RewriteBase /

# If the request is not secure
RewriteCond %{HTTPS} off
# Redirect to the secure version
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

# Normal redirect rules
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L] 
</code></pre>

<p>Thank you @<a href="https://craftcms.stackexchange.com/a/4129/5557">naboovalley</a>!</p>

CC BY-SA 4.0
2019-03-28T19:57:07.457Z
2019-04-04T16:56:15.580Z
2019-04-04T16:56:15.580Z
OuuGiii
<p>For reference, this worked:</p>

<pre><code>RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]
</code></pre>

CC BY-SA 3.0
2017-02-22T10:18:13.183Z
This still causes an `ERR_TOO_MANY_REDIRECTS` for me
Duncan Lukkenaer
CC BY-SA 3.0
2017-11-18T19:49:45.103Z
This worked for a while for me, but now it causes `ERR_TOO_MANY_REDIRECTS`
Keith M
CC BY-SA 3.0
2014-10-14T14:02:06.497Z
2014-10-14T14:02:06.497Z
user1070143
<p>I've installed a ssl cert on a site and it's working. Now I want to redirect visitors coming in on http over to https</p>

<p>I've put this code and only this code in the htaccess file, but it's causing a redirect loop.</p>

<pre><code>&lt;IfModule mod_rewrite.c&gt;
RewriteEngine On

RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://www.mysite.com/$1 [R,L]

&lt;/IfModule&gt;
</code></pre>

<p>My original htaccess looked like this:</p>

<pre><code>&lt;IfModule mod_rewrite.c&gt;
RewriteEngine On

RewriteCond %{HTTP_HOST} ^mysite.com [NC]
RewriteRule ^(.*)$ https://www.mysite.com/$1 [L,R=301]

# Send would-be 404 requests to Craft
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
RewriteRule (.+) index.php?p=$1 [QSA,L]
&lt;/IfModule&gt;
</code></pre>

<p>Could Craft somehow be causing the redirect loop?</p>

<p>In the Craft CP I have the Site URL set to <a href="https://www.mysite.com">https://www.mysite.com</a></p>

CC BY-SA 3.0
2014-10-14T13:12:21.963Z
This may be useful for you, though it's aimed at the control panel rather than the site as a whole: http://craftcookbook.net/recipes/181
Matt Wilcox
CC BY-SA 3.0
2014-10-14T13:16:11.767Z
Thanks. Tried that and this (http://buildwithcraft.com/help/force-ssl), both send admin into a redirect loop.
user1070143
<htaccess>
How do I force SSL on Craft?
# How do I force SSL on Craft?

(Asked by: username_0 on 2014-10-14)

I've installed a ssl cert on a site and it's working. Now I want to redirect visitors coming in on http over to https
I've put this code and only this code in the htaccess file, but it's causing a redirect loop.

RewriteEngine On

RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://www.mysite.com/$1 [R,L]



My original htaccess looked like this:

RewriteEngine On

RewriteCond %{HTTP_HOST} ^mysite.com [NC]
RewriteRule ^(.*)$ https://www.mysite.com/$1 [L,R=301]

# Send would-be 404 requests to Craft
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
RewriteRule (.+) index.php?p=$1 [QSA,L]


Could Craft somehow be causing the redirect loop?
In the Craft CP I have the Site URL set to https://www.mysite.com

**Tags:** htaccess

> **Comments:**
> **username_1**: This may be useful for you, though it's aimed at the control panel rather than the site as a whole: http://craftcookbook.net/recipes/181  
> **username_0**: Thanks. Tried that and this (http://buildwithcraft.com/help/force-ssl), both send admin into a redirect loop.  

---

## 5 answers

### Answer by username_0 on 2014-10-14. Score: 15 | Accepted answer

For reference, this worked:
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]

> **Comments:**
> **username_3**: This still causes an `ERR_TOO_MANY_REDIRECTS` for me  
> **username_7**: This worked for a while for me, but now it causes `ERR_TOO_MANY_REDIRECTS`  

---

### Answer by username_2 on 2014-10-14. Score: 15

I recommend trying out the Patrol plugin. It avoids .htaccess headbanging and just handles the redirects via PHP.

[Patrol Plugin for Craft CMS](https://github.com/selvinortiz/craft.patrol)

In the Settings, turn on `Secure Connections` and add a backslash `/` to the *Protected Areas* settings box. That will force SSL across the board. If you want to get more specific, you can provide multiple, more-specific paths.

> **Comments:**
> **username_3**: The settings changed. Now you need to put `'patrol' => ['forceSsl' => true, 'restrictedAreas' => ['/']]` in `craft/config/general.php`  

---

### Answer by username_4 on 2014-10-14. Score: 6

Try this sample htaccess-file I'm using on another site.
RewriteEngine On
RewriteBase /

# If the request is not secure
RewriteCond %{HTTPS} off
# Redirect to the secure version
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

# Normal redirect rules
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]

> **Comments:**
> **username_0**: Thanks. Even with just that code in the htaccess, I'm still getting a redirect loop.  
> **username_4**: I edited my answer with a complete code. Can you try that one?  

---

### Answer by username_5 on 2019-11-20. Score: 1

I had to adapt the above slightly to play nicely. Hopefully this saves someone some head banging.

 RewriteEngine On

 # If the request is not secure
 RewriteCond %{ENV:HTTPS} !=on
 # Redirect to the secure version
 RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

 # Send would-be 404 requests to Craft
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
 RewriteRule (.+) index.php?p=$1 [QSA,L]


---

### Answer by username_6 on 2019-03-28. Score: 1

Because I have so little reputation I cannot comment or like anything.
But @username_4 's answer did the trick for me! all the other ones gave me  

ERR_TOO_MANY_REDIRECTS!

So the right answer to this question is probably:
RewriteEngine On
RewriteBase /

# If the request is not secure
RewriteCond %{HTTPS} off
# Redirect to the secure version
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

# Normal redirect rules
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L] 

Thank you @username_4!


---

