How to force HTTPS for the entire site
Forcing HTTPS means any attempt to open the site over http is redirected to the secure version, and the browser stops trying http afterward. You want this so there is no parallel unsecured copy of the site and no duplicate URLs for search engines. It has two parts: a redirect and the HSTS header.
Check your site
-
Make sure the certificate covers every hostname
Before forcing HTTPS, check in cPanel SSL/TLS Status that the certificate is valid for the bare domain, www, and any subdomains you use. Otherwise the redirect lands on a version with no certificate and throws an error.
-
Turn on the redirect to https
Add a rule to .htaccess with RewriteCond %{HTTPS} off and a RewriteRule to the https version of the same URL with [R=301,L]. In WordPress, set the https address in Settings > General first to avoid a loop.
-
Collapse to one canonical host
Pick one main version (with or without www) and point everything at it. One redirect from http to https straight to the canonical host is enough, with no chain of two or three hops.
-
Add the HSTS header
In .htaccess add Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains". It tells the browser to use https only for at least a year, even if someone types http by hand.
-
Use includeSubDomains deliberately
The includeSubDomains directive extends the rule to every subdomain. Add it only if each subdomain definitely has a working certificate, otherwise they become unreachable.
-
Update internal links and clear cache
Replace http links in your content with https (Better Search Replace or WP-CLI), then purge the page cache, LiteSpeed Cache, and CDN. That way visitors go straight to https with no extra redirects.
How to verify the result
Type the address with http and a few subdomains, and everything should lead to https with no warnings. Check the certificate and the presence of the HSTS header with the TechGuard SSL checker to confirm forced HTTPS is really on.
Tip: Do not set a large HSTS max-age until you are sure https is stable: browsers remember the rule and you cannot roll it back quickly.
Related guides
Found problems?
Slow hosting, SSL trouble or frequent downtime? Move to TomisHost: fast hosting with free SSL, daily backups and free migration help.
TomisHost hosting