Force HTTPS for a domain in cPanel

Having a certificate is not enough: visitors who type http:// or follow old links still land on the insecure version. Forcing HTTPS sends every request to the secure address with a permanent redirect. This guide covers the one-click toggle in cPanel, the .htaccess method for more control, and the two problems people hit afterwards: redirect loops and mixed content.

Before you start

• A cPanel login for the account.
• A valid certificate on the domain, and on www if you use it. Check cPanel » Security » SSL/TLS Status. If it is missing, see set up AutoSSL in cPanel & WHM.
• The site loading correctly at https://example.com before you force it.

Option 1: the Force HTTPS Redirect toggle

1. In cPanel, open Domains » Domains.
2. Find the domain in the list.
3. Switch on Force HTTPS Redirect.

cPanel adds the redirect at the web server level for that domain. The toggle is greyed out when the domain has no valid certificate, which protects you from the error above.

This is the simplest option and works for most sites. Repeat it for each addon domain or subdomain that needs it.

Option 2: an.htaccess redirect

Use .htaccess when you need more control, such as choosing between www and the bare domain in the same rule.

Open Files » File Manager, turn on Show Hidden Files (dotfiles) in Settings, then edit .htaccess in the domain's document root. Add this at the very top:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

To force HTTPS and send everyone to www:

RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [L,R=301]

Use one method, not both. Two redirect systems for the same domain make loops more likely.

Check it works

From any computer:

curl -sI http://example.com | grep -iE '^(HTTP|location)'
curl -sI https://example.com | head -1

The first command should show a 301 and a Location: starting with https://. The second should show 200 (or the expected redirect to www). Only one hop should happen; check with:

curl -sIL http://example.com | grep -iE '^(HTTP|location)'

Fix redirect loops

"Too many redirects" usually means two layers disagree about whether the request is HTTPS:

• A CDN or proxy in front connects to the server over HTTP while the visitor uses HTTPS. The server keeps redirecting. Set the CDN to connect over HTTPS (full mode), or test the forwarded protocol header in your rule:

  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteCond %{HTTPS} !=on
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

• The application redirects too. WordPress, for example, redirects to its Site Address. Make sure it is set to the https:// address, and the www choice matches your redirect.
• The toggle and an .htaccess rule both apply. Remove one.

Fix mixed content

After switching, a padlock warning usually means the page loads images, scripts or styles over http://. Open the browser developer console; it lists each insecure URL.

• In WordPress, update the site URLs to https:// and run a search-and-replace on the database for the old http://example.com address.
• In themes and custom code, change hard-coded http:// links to https:// or relative paths.
• External resources must support HTTPS. Replace any that do not.

Troubleshooting

• Toggle is greyed out: there is no valid certificate for the domain. Run AutoSSL and check its log.
• Redirect works for the domain but not www: www has no certificate or DNS record. Add it, run AutoSSL, then retest.
• 500 error after editing .htaccess: a typo in the rule. Remove your lines, save, and add them again carefully.
• Old HTTP page still shows: the browser cached the earlier response. Test in a private window or with curl.

Next steps

• Create other redirects: URL redirects in cPanel.
• Install a paid certificate if you need one: install a purchased SSL certificate.