Site Security
Forcing HTTPS So Every Visitor Lands on the Secure Version
Forcing HTTPS closes the gap where visitors, and search engines, might still reach the unencrypted version of a site — done wrong, it also causes an endless redirect loop.
1
cPanel toggle for a one-click HTTPS redirect
301
Status code a proper force-HTTPS redirect should use
Free
Auto-renewing SSL required before forcing HTTPS
24/7
Human support if a redirect loop appears
In short
To force HTTPS, redirect every HTTP request to its HTTPS equivalent, either using cPanel's built-in 'Force HTTPS Redirect' toggle for the domain, which requires no code, or by adding a RewriteCond and RewriteRule pair to .htaccess that checks whether the connection is already secure and redirects to https:// if not. Both approaches send visitors and search engines permanently to the encrypted version.
The most common failure is a redirect loop, which happens when the server sits behind a load balancer or proxy that terminates SSL before the request reaches the actual web server, making the RewriteCond check the wrong header and redirect endlessly — the fix is checking a proxy-forwarded header instead of the standard HTTPS variable in that specific setup.
Having free auto-renewing SSL installed on a domain doesn't automatically mean visitors use it — without a forced redirect, both http:// and https:// versions of every page load side by side, which means links, bookmarks, and search results can just as easily point at the insecure version. Forcing HTTPS closes that gap by making the redirect happen automatically, at the server level, regardless of which version a link or a visitor's typed address points to.
This matters beyond the padlock icon: browsers increasingly flag plain HTTP pages with active warnings, search engines treat HTTPS as a ranking signal, and any page collecting a login or payment detail over unencrypted HTTP is a real, avoidable risk. The setup itself is short, but the two most common ways to do it, a panel toggle or an .htaccess rule, behave slightly differently and it's worth knowing which one to reach for.
Method 1: cPanel's Force HTTPS Redirect Toggle
The simplest route, when SSL is already active on the domain, is cPanel's dedicated 'Domains' section, which typically includes a 'Force HTTPS Redirect' toggle per domain. Switching it on writes the underlying redirect automatically, with no manual .htaccess editing required, and it can be switched off just as easily if something needs troubleshooting.
This is the recommended starting point for most sites, since it avoids hand-editing rewrite rules entirely and is far less prone to producing a loop, because the panel accounts for the server's own SSL termination setup rather than assuming a generic configuration.
Method 2: Forcing HTTPS via .htaccess
Where more control is needed, or the panel toggle isn't available, adding rules directly to .htaccess achieves the same result: a RewriteCond checks whether the request's HTTPS variable is off, and if so, a RewriteRule redirects to the same URL under https:// with a 301 status code, preserving the rest of the path and query string. This needs mod_rewrite enabled, which is standard on cPanel-style hosting.
Because .htaccess is read on every single request, a mistake here can affect the entire site immediately, so back up the current file before adding the rule and test right after saving, checking a couple of different pages rather than just the homepage to confirm the rule applies sitewide, not only to one path.
Avoiding the Redirect Loop
A redirect loop happens when the check used to decide 'is this already HTTPS?' gives the wrong answer, most commonly because the site sits behind a load balancer, CDN, or reverse proxy that terminates the SSL connection itself and forwards the request to the actual web server as plain HTTP internally. The standard HTTPS server variable then reads 'off' even though the visitor's original connection was genuinely secure, and the rule redirects again, and again.
The fix in that specific setup is checking the proxy-forwarded header the load balancer or CDN sets instead of the standard variable, so the rule correctly recognizes a request that arrived securely even though the internal hop to the web server wasn't. If a site suddenly loops after adding a force-HTTPS rule, this mismatch between the actual connection and what the server sees internally is the first thing worth checking.
Checking for Mixed Content After Forcing HTTPS
Forcing the page itself onto HTTPS doesn't automatically fix hardcoded http:// links to images, scripts, or stylesheets still referenced inside the page's own code — those trigger mixed-content warnings, and browsers may block some resource types outright even though the page itself loaded securely. After forcing HTTPS, check the browser console for mixed-content warnings on a few key pages.
Most CMS platforms have a straightforward way to update the site's base URL setting to https:// and a search-and-replace pass through the database for any remaining hardcoded http:// references, which resolves the majority of mixed-content warnings left over after the redirect itself is working correctly.
Every Visitor, Every Link, Straight to HTTPS
A forced redirect turns free SSL from 'available if someone happens to type https://' into the only version of the site anyone actually reaches.
Hosting Cheap includes a one-click Force HTTPS toggle in the cPanel-style panel alongside free auto-renewing SSL, so the whole setup is a couple of clicks, not a manual rewrite rule.
- One-click Force HTTPS Redirect toggle in cPanel
- Free auto-renewing SSL included on every plan
- Full .htaccess access for custom rewrite rules if needed
- 24/7 human support for redirect loop troubleshooting
Why Hosting Cheap
What you get
One-click Force HTTPS toggle
Redirect every visitor to the secure version of the domain without editing any files.
Free auto-renewing SSL
The certificate a forced HTTPS redirect depends on is included and renews automatically.
Full .htaccess access
Write a custom rewrite rule directly when more control than the panel toggle offers is needed.
NVMe SSD + LiteSpeed
The extra redirect hop adds negligible delay thanks to fast underlying infrastructure.
24/7 human support
Get help diagnosing a redirect loop caused by a proxy or load balancer setup.
Daily backups
Test an .htaccess rewrite rule with a recent restore point available if it misbehaves.
How It Works
Get set up in a few steps
Confirm SSL is active first
Force HTTPS only after confirming the domain's SSL certificate is issued and valid.
Enable the redirect
Use cPanel's Force HTTPS toggle, or add a RewriteCond/RewriteRule pair to .htaccess.
Test for loops and mixed content
Load several pages to confirm no redirect loop occurs and check for hardcoded http:// resources.
Included
Everything you need, on every plan
- SSL certificate confirmed active and valid before forcing HTTPS
- cPanel's Force HTTPS toggle tried first where available
- .htaccess backed up before adding a manual rewrite rule
- Redirect tested on more than one page, not just the homepage
- No redirect loop occurring when behind a proxy or CDN
- Proxy-forwarded header checked instead of the standard variable if a loop appears
- Browser console checked for mixed-content warnings after the redirect works
- CMS base URL setting updated to https:// where applicable
FAQ
Frequently asked questions
How do I force HTTPS on my website?
Use cPanel's Force HTTPS Redirect toggle for the domain if it's available, which requires no code, or add a RewriteCond and RewriteRule pair to .htaccess that redirects any non-HTTPS request to its https:// equivalent. SSL needs to already be active on the domain either way.
Why does forcing HTTPS sometimes cause a redirect loop?
A loop typically happens when a load balancer, CDN, or proxy terminates SSL and forwards the request internally as plain HTTP, making the standard HTTPS check read 'off' even for genuinely secure visitor connections. Checking a proxy-forwarded header instead fixes the check in that specific setup.
What .htaccess code forces HTTPS?
A standard rule uses RewriteCond to check %{HTTPS} is off, followed by a RewriteRule that redirects to https://%{HTTP_HOST}%{REQUEST_URI} with a 301 status. mod_rewrite needs to be enabled, which is standard on cPanel-style hosting.
Does forcing HTTPS affect my SEO?
Generally positively — HTTPS is a recognized ranking signal, and a properly set up 301 redirect consolidates ranking signals onto the secure version rather than splitting them between HTTP and HTTPS. Using a 301, not a temporary redirect, is what preserves that value.
Why do I see a 'not fully secure' warning even after forcing HTTPS?
That's usually mixed content — hardcoded http:// links to images, scripts, or stylesheets still referenced inside the page even though the page itself now loads over HTTPS. Updating the CMS base URL and replacing hardcoded http:// references resolves most of these warnings.
Do I need to force HTTPS if I already have an SSL certificate?
Yes — having a certificate installed only makes HTTPS available, it doesn't stop visitors, bookmarks, or search results from still reaching the plain HTTP version unless a redirect actively sends them to HTTPS. The certificate and the forced redirect are two separate steps.
Ready to Put Every Visitor on HTTPS?
Get free auto-renewing SSL and a one-click Force HTTPS toggle, from $2.09/mo.
Get Started