Securing Your Website: How to Force HTTPS Redirection Using .htaccess

After installing an SSL certificate on your Hostyap hosting account, your website becomes accessible via the secure https:// protocol. However, visitors often type your domain name without the protocol (e.g., yourdomain.com) or use the older http:// version. To ensure everyone enjoys a secure connection automatically, you need to set up a redirection rule.

For websites hosted on Apache servers (which Hostyap utilizes), the most effective way to enforce this is by editing the .htaccess file. This file allows you to control server behavior on a per-directory basis. Below, we’ll walk you through the steps to safely configure this redirect.

Step 1: Locate the Correct Directory

Before editing the .htaccess file, you need to ensure you are in the correct folder (known as the “document root”) for your domain.

1. Log in to your Hostyap cPanel account.
2. Navigate to the File Manager section.
3. In the File Manager, you will see a list of directories:
   • If you are setting this up for your primary domain, open the public_html folder.
   • If you are setting this up for an addon domain (a secondary website), you should open the folder listed in the Addon Domains section of cPanel. This is usually a folder named after the domain (e.g., yourdomain.com).

Step 2: Access or Create the .htaccess File

The .htaccess file is a hidden file (it starts with a dot). To view it:

1. Click the Settings button in the top-right corner of the File Manager.
2. Check the box labeled Show Hidden Files (dotfiles) and click Save.
3. Look for a file named .htaccess in your domain’s document root.
   • If it exists: Right-click the file and select Edit.
   • If it does not exist: Click the + File button at the top. Name the file exactly .htaccess (including the dot at the beginning). Once created, right-click it to edit.

Note: When editing, a pop-up window may warn you about editing hidden files. This is a standard security feature; simply confirm by clicking Edit to proceed.

Step 3: Insert the Redirection Code

Once the .htaccess file is open in the editor, you will need to paste the following code. This code checks if the connection is non-secure (HTTP) and redirects the visitor to the secure HTTPS version of the same page.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]
Header always set Content-Security-Policy "upgrade-insecure-requests;"

What this code does:

• RewriteEngine On: Activates the rewriting engine.
• RewriteCond %{HTTPS} !=on: Checks if HTTPS is not currently active.
• RewriteRule: If the condition is met, it forwards the user to the HTTPS version of the same URL.
• [L,R=301,NE]: R=301 tells search engines this is a permanent move (which is good for SEO), and L stops further rules from processing.
• Header always set...: This line ensures that any embedded resources (like images or scripts) on your page are also requested over HTTPS, preventing mixed content warnings.

After pasting the code, click Save Changes.

Step 4: Verify the Redirect

To ensure everything is working correctly, perform a test:

1. Open a new private or incognito browser window (to avoid cached data interference).
2. Type http://yourdomain.com (replace with your actual domain) into the address bar and press Enter.
3. You should be automatically redirected to https://yourdomain.com. The padlock icon in the address bar should appear closed, indicating a secure connection.

Important Considerations for Hostyap Clients

• Check for Existing Code: If your .htaccess file already contains code (for example, from a CMS like WordPress), avoid duplicating the RewriteEngine On line. You can place the RewriteCond and RewriteRule lines just below the existing RewriteEngine On line.
• Backup First: It is always good practice to download a backup of your .htaccess file before making changes. If something goes wrong, you can simply restore the original file.
• SSL Activation: This redirection will only work if the SSL certificate for your domain is already installed and active on your Hostyap hosting package. If you have not yet installed an SSL, please contact our support team or activate it via cPanel first.

By following these steps, you ensure that every visitor to your website enjoys a secure, encrypted connection automatically, boosting both trust and your search engine ranking.