About the Htaccess HTTPS Enforcer Generator
Serving your site over HTTPS is essential for security, user trust, and SEO (Google explicitly uses HTTPS as a ranking signal), but simply installing an SSL certificate isn't enough — you also need to force all HTTP traffic to redirect to HTTPS, or visitors and search engines may continue accessing the insecure version. This generator builds the correct Apache .htaccess rule to enforce HTTPS site-wide.
This tool is useful for site owners who just installed an SSL certificate and need to complete the migration, developers auditing an existing .htaccess file for missing HTTPS enforcement, and webmasters troubleshooting mixed content or duplicate HTTP/HTTPS indexing issues.
To use it, simply click "Generate" — the tool outputs a standard, widely compatible mod_rewrite rule block that checks whether a request arrived over HTTPS, and if not, issues a 301 permanent redirect to the identical URL over HTTPS. There's also an optional variant for servers behind a load balancer or proxy that uses the X-Forwarded-Proto header instead of the standard HTTPS server variable.
For example, the generated rule: RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] ensures that a visitor typing http://example.com/page is automatically and permanently redirected to https://example.com/page, preserving the exact path and query string.
A common mistake is placing this rule after other conflicting RewriteRules in the same .htaccess file, which can create redirect loops or prevent the HTTPS rule from ever being reached — always place HTTPS enforcement rules near the very top of your rewrite rules, right after RewriteEngine On. Another frequent issue occurs on servers behind a proxy or load balancer (common on many cloud hosting platforms), where the standard %{HTTPS} variable may not reflect the original protocol correctly — in that case use the X-Forwarded-Proto variant included in this generator instead.
Tip: after adding this rule, test your site by explicitly visiting the http:// version of several pages to confirm they redirect correctly to https://, and check your SSL certificate is properly installed and trusted before relying on this redirect for production traffic.