: Why does my .htaccess file only partially force HTTPS and WWW? I have the domain https://www.example.com and this is how I prefer that users reach my site as well, using both HTTPS and WWW.

@Jamie184

You need to change your logic. Your conditions are implicitly AND'd (the default), they should be OR'd instead. So, currently the RewriteRule is only processed if the HTTP_HOST is "example.com" AND the SERVER_PORT is 80. You need it to trigger on either of these conditions, so you need to add an OR flag on the first condition.

For example:

RewriteCond %{HTTP_HOST} ^example.com$ [NC,OR]
RewriteCond %{SERVER_PORT} 80
RewriteRule (.*) www.example.com/ [R=301,L]


(No need for string anchors ie. ^ and $ if you are capturing the whole pattern.)

UPDATE: Alternatively, check the HTTPS server variable, instead of SERVER_PORT. For example:

RewriteCond %{HTTPS} !on [OR]
RewriteCond %{HTTP_HOST} =example.com [NC]
RewriteRule (.*) www.example.com/ [R=301,L]


What that says is... for every request that is not HTTPS or is for example.com (ie. no www) then redirect to www.example.com.
Alternatively, you can implement this as two separate rules:

RewriteCond %{HTTPS} !on
RewriteRule (.*) www.example.com/ [R=301,L]

RewriteCond %{HTTP_HOST} =example.com [NC]
RewriteRule (.*) www.example.com/ [R=301,L]


DEBUGGING: Test what these server variables contain on your server. You can (temporarily) replace the above redirect with the following:

RewriteCond %{SERVER_PORT} (.*)
RewriteRule ^ - [E=ENV_SERVER_PORT:%1]

RewriteCond %{HTTPS} (.*)
RewriteRule ^ - [E=ENV_HTTPS:%1]


This will create two environment variables (ENV_SERVER_PORT and ENV_HTTPS) that should be available to your server-side script (eg. PHP). Check what these contain. (eg. in PHP echo getenv('ENV_SERVER_PORT');)

Under HTTP you would expect... ENV_SERVER_PORT to be 80 and ENV_HTTPS to be "off".

Under HTTPS you would expect... ENV_SERVER_PORT to be 443 (default) and ENV_HTTPS to be "on".

Solution

It would seem that the SERVER_PORT and HTTPS Apache server variables are not available. This suggests that you have a front end proxy (or load balancer) that is handling the request.

The related (but not exactly the same - despite having the same name) PHP superglobals SERVER_PORT and HTTPS (specifically $_SERVER['SERVER_PORT'] and $_SERVER['HTTPS']) are, however, being set (by PHP). But SERVER_PORT is always 80 when served over HTTP and HTTPS (this also suggests a front-end proxy). The HTTPS PHP superglobal is, however, correctly set to "on" when served over HTTPS. But we want to avoid doing this redirection in our code (less efficient, more chance of error).

From your server output, it looks like there is an X-Proto HTTP request header (identified by the HTTP_X_PROTO index in the $_SERVER superglobal array) being set (most probably by the proxy server) when served over HTTPS (it is set to the string "SSL"), but when served over a plain HTTP connection this header is not set. We should be able to check for this in .htaccess. Try the following:

RewriteCond %{HTTP:X-Proto} !SSL [OR]
RewriteCond %{HTTP_HOST} =example.com [NC]
RewriteRule (.*) www.example.com/ [R=301,L]


For all requests that do not have an X-Proto HTTP request header set to the string "SSL" or the apex domain is requested then redirect to HTTPS with the www subdomain.

Vote Up Vote Down