To force HTTPS on your website, you need to edit your .htaccess file and add redirect rules that automatically send all HTTP traffic to HTTPS. Before doing this, make sure you have an active SSL certificate installed on your domain—either a purchased certificate or a free Let's Encrypt certificate from your hosting provider.
Prerequisites Before Forcing HTTPS
Before you redirect visitors to HTTPS, verify that your SSL certificate is properly installed and working. Visit your site using https:// in front of your domain name. If you see a padlock icon in the browser address bar without warnings, your certificate is active and you can proceed.
If you don't have an SSL certificate yet, most hosting providers including OBHost offer free Let's Encrypt certificates that you can install through your control panel in minutes.
Step-by-Step Guide to Force HTTPS
Step 1: Access Your File Manager
Log into your cPanel hosting account and open the File Manager tool. This allows you to edit files on your server without needing FTP software.
Step 2: Enable Hidden Files
Before you can see the .htaccess file, you need to enable hidden files (also called dotfiles) in File Manager. Click on Settings in the top-right corner and check the box labeled Show Hidden Files (dotfiles), then click Save.
Step 3: Locate Your .htaccess File
Navigate to the folder containing your website files. For most websites, this is the public_html directory. Look for a file named .htaccess. If you don't see one, you can create a new file with this exact name.
Step 4: Edit the .htaccess File
Right-click on the .htaccess file and select Edit. If you're creating a new file, click File in the top menu, then New File, name it .htaccess, and open it for editing.
Add the following code at the very top of the file, before any existing content:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
This code does three things: it activates the rewrite engine, checks if the connection is not using HTTPS, and redirects the visitor to the HTTPS version of the same page with a permanent 301 redirect.
Step 5: Save and Test
Click Save Changes to update the .htaccess file. Clear your browser cache completely (or open an incognito/private window) and visit your website using the regular HTTP address. Your browser should automatically redirect to the HTTPS version.
Troubleshooting Common Issues
Redirect Loops
If you experience infinite redirect loops, your server might be behind a proxy or load balancer. In this case, try this alternative code instead:
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Changes Not Taking Effect
If the redirect isn't working, make sure you cleared your browser cache completely. Browsers cache redirects aggressively, so old HTTP pages might still load from cache. Also verify that the .htaccess file is in the correct directory—it needs to be in the same folder as your website's index file.
SSL Certificate Warnings
If visitors see security warnings after you enable HTTPS, your SSL certificate might not be properly installed or might have expired. Check your certificate status in cPanel's SSL/TLS Status tool.
Why Force HTTPS on Your Website
Forcing HTTPS provides several important benefits. Search engines like Google give ranking preference to HTTPS websites, so this simple change can improve your SEO performance. Modern browsers mark HTTP sites as "not secure," which can scare away visitors and hurt your credibility.
More importantly, HTTPS encrypts all data between your website and your visitors, protecting passwords, personal information, and payment details from interception. This is essential for building trust and complying with privacy regulations.
Frequently Asked Questions
Will forcing HTTPS affect my search engine rankings?
Forcing HTTPS will positively impact your SEO rankings. Search engines prefer secure websites and may penalize sites that remain on HTTP. However, make sure to set up proper 301 redirects (as shown above) so search engines understand that your HTTP pages have permanently moved to HTTPS.
Can I force HTTPS on only part of my website?
Yes, you can force HTTPS on specific folders or pages by placing the .htaccess file in that specific directory instead of your root public_html folder. The rules will only apply to that folder and its subfolders. However, security best practices recommend using HTTPS across your entire website.
What happens if I force HTTPS without installing an SSL certificate first?
If you force HTTPS before installing an SSL certificate, visitors will see security warnings and won't be able to access your website. Always install and verify your SSL certificate is working before adding HTTPS redirect rules.
Do I need to update internal links after forcing HTTPS?
While the .htaccess redirect will automatically send HTTP traffic to HTTPS, it's good practice to update your internal links to use HTTPS directly. This reduces unnecessary redirects and improves page load speed. Update links in your website code, database, and content management system settings.
If you need assistance with SSL certificates or forcing HTTPS on your website, the OBHost support team is available 24/7 to help. Visit https://www.obhost.net/contact or email support@obhost.org for technical support.
