How to Use .htaccess to Move Your Site to SSL

A few years ago, setting up an SSL certificate was a slow and costly painful process.

At one point, we were paying over $500 per year for a top-of-the-line SSL certificate on this site. Plus, many platforms had poor support for SSLs.

All that has changed. You can get free SSL certificates now, and web software almost always has great support for your SSLs.

The tricky part of using an SSL certificate is now making sure you aren’t loading images or files over http. This will cause your SSL certificate to show an error. Here’s the code we used in our .htaccess to push all our site’s assets to https.

Moving your whole site to SSL

This code should push all the URLs on your site to use https and www.

Here’s the code in our .htaccess file:

# First rewrite to HTTPS:
# Don't put www. here. If it is already there it will be included, if not
# the subsequent rule will catch it.

RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Now, rewrite any request to the wrong domain to use www.

RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Excluding some pages from SSL

After moving to SSL-only, we had some problems with our RSS feed.

MailChimp, Feedburner, Amazon, dlvr.it and other services didn’t seem like an RSS feed run over SSL. This turns out to be a common problem that the providers themselves don’t seem to have solved.

So, we needed to exclude at least one URL from the SSL. The full URL to our feed is:
http://www.ostraining.com/index.php?option=com_obrss&task=feed&id=1

Here’s the code we used to run that URL on http. We placed this code before the other SSL rules:

# Exceptions for HTTPS
RewriteCond %{HTTPS} off
RewriteCond %{QUERY_STRING} !^option=com_obrss&task=feed&id=1

Notice that we had to remove index.php? from the URL to get this rule to work correctly.