How do I force SSL/HTTPS on my websites?

You can force visitors to use SSL/HTTPS by adding rewrite rules to your site’s .htaccess file.

Caution

You must have an SSL certificate installed before enabling HTTPS redirects. Hawk Host provides free SSL certificates through Let’s Encrypt — see How do I mass install my free Let’s Encrypt SSL certificates? for instructions.

Force SSL on all websites

Add this rule to your .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Force SSL on a specific domain only

Replace domain.com with your actual domain name:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^domain\.com [OR,NC]
RewriteCond %{HTTP_HOST} ^www\.domain\.com [NC]
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]