How to Redirect HTTP to HTTPS: Apache, Nginx, cPanel, WordPress

To redirect HTTP to HTTPS, add a permanent 301 redirect in one place: a Redirect in your Apache port-80 virtual host or .htaccess, a return 301 server block in Nginx, cPanel's Force HTTPS Redirect toggle, or Cloudflare's Always Use HTTPS. Make sure a valid certificate is installed first, and send every URL to its exact HTTPS equivalent in one hop.

This guide gives copy-paste snippets for each platform, then covers WordPress settings, redirect loops, www handling and how to test the result.

Before you start: is HTTPS working?

A redirect to a broken HTTPS site just moves the error. Check that https://example.com and https://www.example.com both load with a valid certificate and no warnings. If not, sort the certificate first; most hosts provide a free one through AutoSSL or their dashboard.

Then decide on one canonical hostname: either www or the bare domain. Google recommends choosing a preferred URL and redirecting the others to it, using "a permanent server-side redirect whenever possible".

Which redirect status code should I use?

Use 301 (or 308) for HTTP to HTTPS. Google treats both as permanent and passes signals to the target URL. Avoid 302 and 307, which tell search engines the move is temporary, and avoid JavaScript or meta refresh redirects, which are slower and less reliable.

Pick one layer. Stacking a Cloudflare rule, an .htaccess rule and a plugin is the usual cause of chains and loops.

How do I redirect HTTP to HTTPS in Apache?

If you can edit the virtual host, this is the cleanest option and doesn't need mod_rewrite:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    Redirect permanent / https://www.example.com/
</VirtualHost>

Redirect keeps the path and query string, so http://example.com/shop?id=4 goes to https://www.example.com/shop?id=4. Reload with sudo systemctl reload apache2 (or httpd).

On shared hosting you usually only have .htaccess. Put this at the top of the file in your web root:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^example\.co\.uk$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [L,R=301]

This handles HTTP and the non-www hostname in a single hop. If your site is behind a proxy or load balancer that terminates TLS, %{HTTPS} may always be off; check %{HTTP:X-Forwarded-Proto} instead, or you will create a loop.

How do I redirect HTTP to HTTPS in Nginx?

Add a dedicated server block for port 80:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com;
    # ssl_certificate and ssl_certificate_key lines here
    return 301 https://www.example.com$request_uri;
}

Your main server block for www.example.com on 443 then serves the site. return 301 is faster and clearer than rewrite. Test and reload with sudo nginx -t && sudo systemctl reload nginx.

If you used Certbot with --nginx, it may already have added a redirect; check before adding another.

How do I force HTTPS in cPanel?

1. Log in to cPanel and open Domains.
2. Find your domain in the table.
3. Switch on Force HTTPS Redirect.

The toggle only works once the domain has a valid certificate, and it doesn't appear for aliases. It adds the rewrite for you, so don't also add one by hand in .htaccess. If you need the www/non-www redirect too, cPanel's Redirects tool or the .htaccess snippet above handles it.

How do I redirect HTTP to HTTPS in Cloudflare?

1. In the Cloudflare dashboard, open SSL/TLS > Edge Certificates.
2. Turn on Always Use HTTPS. It is available on every plan, including Free, but doesn't appear while the encryption mode is Off.
3. Under SSL/TLS > Overview, set the mode to Full (strict) if your origin has a valid certificate.

The classic trap is Flexible mode combined with an HTTPS redirect at your server. In Flexible mode Cloudflare connects to your origin over HTTP; your server redirects to HTTPS; Cloudflare requests HTTP again; and the browser shows "too many redirects". Cloudflare's fix is to switch to Full or Full (strict), or remove the origin redirect and enforce HTTPS at the edge only.

How do I switch WordPress to HTTPS?

1. Install a certificate and make sure the HTTPS site loads.
2. Go to Settings > General and change both WordPress Address (URL) and Site Address (URL) to https://.
3. Add the server-level 301 redirect using one of the methods above. WordPress itself doesn't redirect every request.
4. Update old URLs stored in the database. Since WordPress 5.7, core swaps insecure links to your own domain on the fly when you change the site URLs, but it doesn't rewrite the stored content. A careful search-and-replace with WP-CLI fixes that permanently:

wp search-replace 'http://www.example.com' 'https://www.example.com' --skip-columns=guid --dry-run

Remove --dry-run once the counts look right, and take a backup first. Our guide to speeding up WordPress explains why fewer redirect plugins also means a faster site.

How do I test my HTTPS redirect?

Use curl to see every hop:

curl -sIL http://example.com/about | grep -iE '^(HTTP|location)'

You want exactly one 301 followed by a 200. Test all four variants: http://, http://www., https:// and https://www.. Two or more redirects in a row is a chain; our guide to broken links and redirect chains explains why chains waste crawl budget and slow first visits.

A free MakeItFlow website security scan checks the HTTP-to-HTTPS redirect automatically, along with the certificate, HSTS and mixed content.

What to do next

Choose one place to enforce HTTPS, add the snippet, and test the four URL variants with curl. Once the redirect has run cleanly for a few weeks, add HSTS so browsers skip the insecure first request entirely. With Chrome now asking users before loading HTTP pages by default, a clean redirect matters more than ever, so run a free website audit with MakeItFlow to confirm nothing still serves plain HTTP.

Frequently asked questions

Will redirecting to HTTPS affect my SEO?

A clean 301 from each HTTP URL to its exact HTTPS equivalent passes ranking signals to the new URL. Update internal links, your XML sitemap and canonical tags to HTTPS too, so Google doesn't have to follow redirects to find your pages.

Why do I get "too many redirects" after enabling HTTPS?

Two layers are fighting: commonly Cloudflare Flexible mode plus a server redirect, or a proxy that hides HTTPS from your server. Remove one redirect, or switch Cloudflare to Full (strict).

Should I redirect to www or non-www?

Either works. Pick one, redirect the other in the same hop as HTTP to HTTPS, and use it consistently in canonical tags, sitemaps and Search Console.

Do I need to redirect every page individually?

No. The snippets above match every path and keep it intact, so /contact goes to /contact on HTTPS. Redirecting everything to the homepage would harm both users and SEO.

Does the redirect protect against interception?

Mostly, but the very first HTTP request can still be intercepted before the redirect arrives. HSTS closes that gap by telling browsers to use HTTPS directly on future visits.

Related reading

• HTTP/3 and QUIC Explained: Will It Make Your Site Faster?: HTTP/3 and QUIC explained: when they make a website faster, browser and CDN support, and how to enable and test HTTP/3 on Cloudflare, LiteSpeed and Nginx.

Sources

• Google Search Central: Redirects and Google Search
• cPanel: Domains (Force HTTPS Redirect)
• Cloudflare: Always Use HTTPS
• Cloudflare: ERR_TOO_MANY_REDIRECTS
• Make WordPress Core: Improved HTTPS detection and migration in WordPress 5.7