Force secure access via HTTPS

Before redirecting, check that the domain and the variants you need present a valid certificate via https://. Enabling the redirect without proper coverage can make the website inaccessible or show a security warning.

When available, use cPanel > Domains > Force HTTPS Redirect. cPanel will apply the redirect to the selected domain without you having to maintain a manual rule.

For a static website you can also add these rules at the start of the .htaccess file. Replace example.com with the real canonical name. Do not place this fixed-destination variant in an .htaccess shared by addon domains or subdomains: it would also redirect their requests to the canonical domain given.

RewriteEngine On 
RewriteCond %{HTTPS} off 
RewriteRule ^ https://example.com%{REQUEST_URI} [R=302,L]

Make a copy of the file. The example first uses a temporary R=302 redirect. Once you have checked pages, forms, APIs and mixed content, change the code to R=301. If the website is behind a proxy, avoid adding rules until you confirm how the proxy passes on the original protocol, as incorrect detection can create a loop.

Check an internal URL with parameters, as well as the home page, and verify that it ends up at the same resource under HTTPS. In applications with their own routes, use their URL settings together with a single consistent rule; do not paste the rule inside a generated block that the application may overwrite.

If loops appear, remove the change you just added and review the redirect chain before testing again. The browser may remember an earlier permanent redirect; compare with a clean session. HTTPS must still present a valid certificate before each redirect from a URL that already starts with https://.