Forcing HTTP traffic to HTTPS using .htaccess

Question

This is something for me I can never get right. I have tried lots of different methods but none of them seem to be working for me.

I want to force all traffic trying to access HTTP to be automatically redirected to HTTPS.

My .htaccess looks like this:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^(www.)yourdomainname.com
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Not sure if it's relevant but my website is running on a VPS using Apache.

If someone could help me with a solution and what I was doing wrong it would be greatly appreciated.

EDIT: Here is my httpd.conf file: http://pastebin.com/VMYXGi0X

Answer 1

It's possible that there's some routing happening before the request actually gets to your apache server, therefore the HTTPS may not be handled there. You can try replacing this line:

RewriteCond %{HTTPS} off

with

RewriteCond %{HTTP:X-Forwarded-Proto} ^http$ [NC]

to trap the original protocol.

Answer 2

Found the problem.

Following this guide, I tuned the Virtual Hosts in my httpd.conf to suit my website. However this then sent my URL into a redirect loop, creating another problem.

I then found this Stackoverflow answer to be very helpful, explaining that Amazon's X-Forwarded-Proto , like so:

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule !/status https://%{SERVER_NAME}%{REQUEST_URI} [L,R]