Forcing Entire site to HTTPS

[joony]

We have a Wordpress site and hope to force everything to HTTPS.

1. We change the site name (in wordpress settings) to https://mydomain.com
2. In the htaccess code = http://moz.com/blog/htaccess-file-snippets-for-seos

3. Ensure we are using HTTPS version of the site.

• RewriteCond %{HTTPS} !on
• RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

but some blogs http://stackoverflow.com/questions/19168489/https-force-redirect-not-working-in-wordpress say

• RewriteCond %{HTTPS} off
• RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Which one is right? and are we missing anything?

[MickEdwards]

It looks like you should be going for

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This is saying that the condition is off - so non HTTPS URL calls then have the rewrite rule to switch to HTTPS

RewriteCond %{HTTPS} on  - is looking for HTTPS URL calls, so the opposite.

Test it and see what happens.  You can always restore your backup .htaccess if you hit problems.  Please be aware that your server set-up may mean this doesn't work and you'll have to delve deeper.

[joony]

Thanks for the reply Mick,

so if we are implementing HTTPS for the first time,

"RewriteCond %{HTTPS} on " is the right rule, right?

Thanks in advance for your time

[MickEdwards]

No it isn't.  As I said -

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This is saying that the condition is off - so non HTTPS URL calls then have the rewrite rule to switch to HTTPS.