How to redirect HTTP to HTTPS in Apache

Redirecting HTTP to HTTPS is a necessary step to secure web traffic. HTTP transmits data in plain text, leaving it vulnerable to interception. HTTPS, however, encrypts the data, ensuring that sensitive information, like login credentials, remains secure.

Using HTTPS is not just for e-commerce or banking websites anymore. Modern browsers display warnings for sites that still use HTTP, which can erode user trust. Enforcing HTTPS across your website prevents these warnings and enhances security.

In an Apache web server, there are multiple ways to redirect HTTP to HTTPS. These methods typically involve configurations in .htaccess, VirtualHost, or using the Redirect directive. Implementing these correctly ensures all user connections are secure.

Methods to redirect HTTP to HTTPS in Apache:

Redirect HTTP to HTTPS in Apache using htaccess
Redirect HTTP to HTTPS in Apache using mod_rewrite on VirtualHost configuration
Redirect HTTP to HTTPS in Apache using Redirect directive

Redirect HTTP to HTTPS in Apache using htaccess

The .htaccess file is commonly used for server configuration on a per-directory basis. Redirecting HTTP to HTTPS using .htaccess is a flexible and straightforward method, especially suitable for shared hosting environments where direct access to server configuration files may be limited. This method leverages the mod_rewrite module to enforce the redirection.

One advantage of using .htaccess is that changes can be made without needing to restart the Apache server. However, this method can introduce a slight performance overhead due to the need to parse .htaccess files on every request. Despite this, it remains a widely used and effective solution for securing websites with HTTPS.

Enable rewrite module for Apache.

$ sudo a2enmod rewrite # Ubuntu, Debian and SUSE variants
Enabling module rewrite.
To activate the new configuration, you need to run:
  systemctl restart apache2

Distribution with a2enmod support can simply run the command above without having to manually enable the required modules.
CentOS and Red Hat enables the module by default so requires no manual action to enable the modules.

Options	Debian, Ubuntu	openSUSE and SLES	Fedora Core, CentOS, RHEL	macOS	homebrew	xampp
a2enmod support	yes	yes	no	no	no	no
Modules to install	none
Module name	n/a			rewrite
Loadmodule directive	n/a			LoadModule rewrite_module <module_locations>/mod_rewrite.so

Open or create a .htaccess file on the web folder where you want to set the redirection from using your preferred text editor.
```
$ sudo vi /var/www/html/.htaccess
```

Add redirect directive from within the .htaccess file.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://www.simplified.guide/$1 [R,L]

Hard-reload the web page to test the redirect.

Redirect HTTP to HTTPS in Apache using mod_rewrite on VirtualHost configuration

The VirtualHost configuration method offers more control and is ideal for environments where you manage multiple domains or subdomains on a single server. Unlike .htaccess, the VirtualHost configuration applies at the server level, providing a more efficient way to handle redirections since it avoids the overhead of processing .htaccess files.

This method is particularly beneficial when dealing with a large-scale website or a server with heavy traffic. However, it requires access to the server’s configuration files and the ability to restart the Apache service to apply changes. This makes it less suitable for shared hosting environments but ideal for dedicated servers and VPS where you have full control over the server.

Enable rewrite module for Apache.

$ sudo a2enmod rewrite # Ubuntu, Debian and SUSE variants
Enabling module rewrite.
To activate the new configuration, you need to run:
  systemctl restart apache2

Distribution with a2enmod support can simply run the command above without having to manually enable the required modules.
CentOS and Red Hat enables the module by default so requires no manual action to enable the modules.

Options	Debian, Ubuntu	openSUSE and SLES	Fedora Core, CentOS, RHEL	macOS	homebrew	xampp
a2enmod support	yes	yes	no	no	no	no
Modules to install	none
Module name	n/a			rewrite
Loadmodule directive	n/a			LoadModule rewrite_module <module_locations>/mod_rewrite.so

Open VirtualHost config that you want to set up the redirection from using your favorite text editor.
```
$ sudo vi /etc/apache2/sites-enabled/000-default.conf
```
Related: Location for Apache VirtualHost configuration

Add RewriteRule and related directive in the VirtualHost configuration just as the htaccess method.

<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://www.simplified.guide/$1 [R,L] 
</VirtualHost>

Restart Apache for the changes to take effect.

$ sudo systemctl restart apache2 # Ubuntu, Debian
$ sudo systemctl restart httpd # CentOS and Red Hat

Redirect HTTP to HTTPS in Apache using Redirect directive

The Redirect directive is the simplest way to enforce HTTPS redirection. This method is particularly useful when you need a quick and easy solution, or when the use of .htaccess or mod_rewrite is not necessary. The Redirect directive is placed within the VirtualHost configuration, making it a lightweight option.

While this method is straightforward and efficient, it lacks the flexibility of .htaccess or mod_rewrite. It is best suited for scenarios where you need to apply a basic redirection without additional conditions or complex rules. This approach is often used in simple setups where minimal configuration is required.

Open VirtualHost config for HTTP that you want to set up the redirection from using your favorite text editor.
```
$ sudo vi /etc/apache2/sites-enabled/000-default.conf
```
Related: Location for Apache VirtualHost configuration
Add redirect directive within the VirtualHost configuration to redirect to the HTTPS URL.
```
<VirtualHost *:80>
    ServerName simplified.guide
    Redirect permanent / https://www.simplified.guide/
</VirtualHost>
```
permanent is equivalent to 301 redirect and you can use temporary instead for 302 redirect.

Restart Apache to apply the changes.

$ sudo systemctl restart apache2 # Ubuntu, Debian
$ sudo systemctl restart httpd # CentOS and Red Hat

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is an experienced cloud architect with a strong development and open-source advocacy background. He boasts multiple certifications in AWS, Red Hat, VMware, ITIL, and Linux, underscoring his expertise in cloud architecture and system administration.

Discuss the article:

Comment anonymously. Login not required.