How to redirect HTTP to HTTPS in Apache

Securing web traffic is essential to protect data exchanged between servers and clients, especially when sensitive details are involved. Communication over HTTP remains unencrypted, exposing it to potential interception or tampering. Switching to HTTPS ensures data is transmitted securely via encryption protocols, mitigating security risks.

Modern browsers now flag websites that rely on HTTP, which undermines user trust and can result in negative user experiences. Encrypted connections help maintain credibility, meet evolving security standards, and safeguard valuable information. Adopting HTTPS also fosters confidence among visitors and satisfies many compliance requirements.

Implementing HTTPS redirection in Apache enforces secure connections for all incoming traffic. Proper configuration reduces the risk of data exposure by redirecting client requests to encrypted channels. Ensuring consistent use of HTTPS bolsters both performance and security on modern websites.

Methods to redirect HTTP to HTTPS in Apache:

Redirect HTTP to HTTPS in Apache using htaccess
Redirect HTTP to HTTPS in Apache using mod_rewrite on VirtualHost configuration
Redirect HTTP to HTTPS in Apache using Redirect directive

Redirect HTTP to HTTPS in Apache using htaccess

The .htaccess file is commonly used for server configuration on a per-directory basis. Redirecting HTTP to HTTPS using .htaccess is a flexible and straightforward method, especially suitable for shared hosting environments where direct access to server configuration files may be limited. This method leverages the mod_rewrite module to enforce the redirection.

One advantage of using .htaccess is that changes can be made without needing to restart the Apache server. However, this method can introduce a slight performance overhead due to the need to parse .htaccess files on every request. Despite this, it remains a widely used and effective solution for securing websites with HTTPS.

Enable rewrite module for Apache.

$ sudo a2enmod rewrite # Ubuntu, Debian and SUSE variants
Enabling module rewrite.
To activate the new configuration, you need to run:
  systemctl restart apache2

Distribution with a2enmod support can simply run the command above without having to manually enable the required modules.
CentOS and Red Hat enables the module by default so requires no manual action to enable the modules.

Options	Debian, Ubuntu	openSUSE and SLES	Fedora Core, CentOS, RHEL	macOS	homebrew	xampp
a2enmod support	yes	yes	no	no	no	no
Modules to install	none
Module name	n/a			rewrite
Loadmodule directive	n/a			LoadModule rewrite_module <module_locations>/mod_rewrite.so

Open or create a .htaccess file on the web folder where you want to set the redirection from using your preferred text editor.
```
$ sudo vi /var/www/html/.htaccess
```

Add redirect directive from within the .htaccess file.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://www.simplified.guide/$1 [R,L]

Hard-reload the web page to test the redirect.

Redirect HTTP to HTTPS in Apache using mod_rewrite on VirtualHost configuration

The VirtualHost configuration method offers more control and is ideal for environments where you manage multiple domains or subdomains on a single server. Unlike .htaccess, the VirtualHost configuration applies at the server level, providing a more efficient way to handle redirections since it avoids the overhead of processing .htaccess files.

This method is particularly beneficial when dealing with a large-scale website or a server with heavy traffic. However, it requires access to the server’s configuration files and the ability to restart the Apache service to apply changes. This makes it less suitable for shared hosting environments but ideal for dedicated servers and VPS where you have full control over the server.

Enable rewrite module for Apache.

$ sudo a2enmod rewrite # Ubuntu, Debian and SUSE variants
Enabling module rewrite.
To activate the new configuration, you need to run:
  systemctl restart apache2

Distribution with a2enmod support can simply run the command above without having to manually enable the required modules.
CentOS and Red Hat enables the module by default so requires no manual action to enable the modules.

Options	Debian, Ubuntu	openSUSE and SLES	Fedora Core, CentOS, RHEL	macOS	homebrew	xampp
a2enmod support	yes	yes	no	no	no	no
Modules to install	none
Module name	n/a			rewrite
Loadmodule directive	n/a			LoadModule rewrite_module <module_locations>/mod_rewrite.so

Open VirtualHost config that you want to set up the redirection from using your favorite text editor.
```
$ sudo vi /etc/apache2/sites-enabled/000-default.conf
```
Related: Location for Apache VirtualHost configuration

Add RewriteRule and related directive in the VirtualHost configuration just as the htaccess method.

<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://www.simplified.guide/$1 [R,L] 
</VirtualHost>

Restart Apache for the changes to take effect.

$ sudo systemctl restart apache2 # Ubuntu, Debian
$ sudo systemctl restart httpd # CentOS and Red Hat

Redirect HTTP to HTTPS in Apache using Redirect directive

The Redirect directive is the simplest way to enforce HTTPS redirection. This method is particularly useful when you need a quick and easy solution, or when the use of .htaccess or mod_rewrite is not necessary. The Redirect directive is placed within the VirtualHost configuration, making it a lightweight option.

While this method is straightforward and efficient, it lacks the flexibility of .htaccess or mod_rewrite. It is best suited for scenarios where you need to apply a basic redirection without additional conditions or complex rules. This approach is often used in simple setups where minimal configuration is required.

Open VirtualHost config for HTTP that you want to set up the redirection from using your favorite text editor.
```
$ sudo vi /etc/apache2/sites-enabled/000-default.conf
```
Related: Location for Apache VirtualHost configuration
Add redirect directive within the VirtualHost configuration to redirect to the HTTPS URL.
```
<VirtualHost *:80>
    ServerName simplified.guide
    Redirect permanent / https://www.simplified.guide/
</VirtualHost>
```
permanent is equivalent to 301 redirect and you can use temporary instead for 302 redirect.

Restart Apache to apply the changes.

$ sudo systemctl restart apache2 # Ubuntu, Debian
$ sudo systemctl restart httpd # CentOS and Red Hat

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.

Discuss the article:

Comment anonymously. Login not required.