11

In the backend, I've enabled Use Secure URLs in the Frontend. But users can still visit my site through non-secure URLs, except for checkout/account pages.

I want to force secure URLs on all pages. What I do right now is change the unsecure base URL to "https://...."

It seems working. If users use HTTP, they'll be redirected to https. But I wonder if this is the correct way to do it. Any side effects?

Improve this question
1
  • ive heard that correct way is to override secure route in config.xml
    – user2857
    Commented Jun 8, 2015 at 20:15

5 Answers 5

Reset to default
16

The default answer is, set the unsecure base url to https:// depending on your setup this already is enough for a redirect if users try to use http://

Maybe a redirect on webserver level is better, as it avoids requests going through php first.

And if you want the real perfectly secure solution, you should add your website on https://hstspreload.appspot.com/ . But careful with this, if you need to change your certificate, this can cause big problems. Let your Hoster care about this Part.

Improve this answer
3
5

For anyone stumbling across this (like I did)

Don't use htaccess. Under admin go Stores -> General -> Web and change -> Use Secure URLs on Storefront -> Yes and Use Secure URLs in Admin -> Yes

There's no need to edit any files.

Improve this answer
2
  • 1
    Whoa, good timing. answered yesterday. I believe this should be the answer... at least, it is forcing https on frontend and admin for me without touching apache. The currently selected answer enables HTTPS, but this answer "forces" https.
    – Joe Fletcher
    Commented Dec 23, 2017 at 0:03
  • 1
    This is exactly what the questioner said their tried and that it didn't work
    – Dom
    Commented Sep 4, 2018 at 14:46
4

you can do this with .htaccess in apache. Use these lines:

############################ Force SSL ############################
RewriteCond %{HTTP_HOST} !^localhost$
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
############################ Force SSL ############################
Improve this answer
2

I have tried the previous solutions and even though they seemed to work they locked me out of admin panel (don't completely understand the reason).

To get into the admin panel again I had to get into phpmyadmin and get into to database table core_config_data and change both paths: web/secure/use_in_adminhtml and web/unsecure/base_url get back into the admin panel again. And don't forget to clear out the cache folder if you have to make edits in the database...

So I applied the following .htaccess solution instead which let me login to admin as well

# AFTER THIS SECTION
############################################
## workaround for HTTP authorization
## in CGI environment
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# PUT THIS 
############# ALL PAGES HTTPS #################
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !/admin/
RewriteCond %{REQUEST_URI} !/downloader/
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
############# ALL PAGES HTTPS #################

Hope it helps someone

Improve this answer
1

Most approaches on .htaccess would redirect most pages to home when accessed via http.

Example: http://www.mystore.com/productA.html => http://www.mystore.com/

instead of https://www.mystore.com/productA.html

I solved it with the following .htaccess rewrite (Apache only, of course):

#Force SSL
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

See source.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.