Redirect HTTP traffic to HTTPS

Send every insecure request to the secure version with a permanent 301 redirect.

10 min

why this matters

Old links, printed URLs and typed addresses still start at http://. If they stay there, visitors see a security warning and search engines see two copies of every page.

Step by step

Add the redirect at your web server

Return a 301 for every HTTP request rather than serving content on port 80.

# nginx
server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://example.com$request_uri;
}

Apache alternative

If you run Apache with .htaccess, use mod_rewrite instead.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

3
Add HSTS once you are confident
HSTS tells browsers never to try HTTP again, which removes the redirect round trip. Only add it after HTTPS has worked without issue for a while.
```
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
```