---
title: "Forcing HTTP redirect to SSL"
date: "2014-11-09"
category: "ssl"
slug: "forcing-http-redirect-to-ssl"
---

There are several ways to redirect HTTP traffic to HTTPS. Ensure your SSL certificate is installed and working before applying any of these methods.

## Strict Transport Security (HSTS)

[HTTP Strict Transport Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) (HSTS) instructs browsers to use HTTPS for all future requests to your domain.

Add the following to a [[htaccess-guide]] file in the [[where-is-site-content-served-from]] of the domain or subdomain:

```
Header always set Strict-Transport-Security "max-age=63072000;"
```

To extend this policy to subdomains (e.g., forum.example.com, blog.example.com), add `includeSubdomains`:

```
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
```

**Pros:** Easy to implement, directive is cached in the browser, can propagate to subdomains.

**Cons:** The first request over HTTP is not encrypted. Requires browser support.

## mod\_rewrite Redirect

Using [mod\_rewrite](http://httpd.apache.org/docs/current/mod/mod_rewrite.html), add the following to a [[htaccess-guide]] file in the [[where-is-site-content-served-from]] of the domain or subdomain you want to redirect:

RewriteEngine On
RewriteBase /
RewriteCond %{HTTPS} !^on$
RewriteRule ^(.\*)$ https://%{HTTP\_HOST}/$1 [R,L]

**Pros:** Extremely flexible.

**Cons:** Can be complex, does not extend to subdomains without a [[sharing-htaccess-rules]] directory, and may create redirect loops.

## WordPress

WordPress generates absolute URLs. If originally installed over `http://`, all generated links will use `http://`.

To switch to HTTPS, log in to the WordPress [[access-wordpress-admin-panel]] and go to **Settings** > **General**. Change both the **WordPress Address** and **Site Address** fields from `http://...` to `https://...`.

If older posts still contain `http://` links, use a plugin such as [Really Simple SSL](https://wordpress.org/plugins/really-simple-ssl/) to update all existing content.

![](kb-image:wordpress-ssl.png)
*WordPress SSL tunables*
