In the backend, I've enabled Use Secure URLs in the Frontend. But users can still visit my site through non-secure URLs, except for checkout/account pages.

I want to force secure URLs on all pages. What I do right now is change the unsecure base URL to "https://...."

It seems working. If users use HTTP, they'll be redirected to https. But I wonder if this is the correct way to do it. Any side effects?

  • ive heard that correct way is to override secure route in config.xml – user2857 Jun 8 '15 at 20:15
up vote 14 down vote accepted

The default answer is, set the unsecure base url to https:// depending on your setup this already is enough for a redirect if users try to use http://

Maybe a redirect on webserver level is better, as it avoids requests going through php first.

And if you want the real perfectly secure solution, you should add your website on https://hstspreload.appspot.com/ . But careful with this, if you need to change your certificate, this can cause big problems. Let your Hoster care about this Part.

you can do this with .htaccess in apache. Use these lines:

############################ Force SSL ############################
RewriteCond %{HTTP_HOST} !^localhost$
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
############################ Force SSL ############################

I have tried the previous solutions and even though they seemed to work they locked me out of admin panel (don't completely understand the reason).

To get into the admin panel again I had to get into phpmyadmin and get into to database table core_config_data and change both paths: web/secure/use_in_adminhtml and web/unsecure/base_url get back into the admin panel again. And don't forget to clear out the cache folder if you have to make edits in the database...

So I applied the following .htaccess solution instead which let me login to admin as well

# AFTER THIS SECTION
############################################
## workaround for HTTP authorization
## in CGI environment
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# PUT THIS 
############# ALL PAGES HTTPS #################
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !/admin/
RewriteCond %{REQUEST_URI} !/downloader/
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
############# ALL PAGES HTTPS #################

Hope it helps someone

For anyone stumbling across this (like I did)

Don't use htaccess. Under admin go Stores -> General -> Web and change -> Use Secure URLs on Storefront -> Yes and Use Secure URLs in Admin -> Yes

There's no need to edit any files.

  • Whoa, good timing. answered yesterday. I believe this should be the answer... at least, it is forcing https on frontend and admin for me without touching apache. The currently selected answer enables HTTPS, but this answer "forces" https. – Joe Fletcher Dec 23 '17 at 0:03
  • 1
    This is exactly what the questioner said their tried and that it didn't work – Dom Sep 4 at 14:46

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.