Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I only want to have 3 pages able to be accessed via HTTPS. All other pages should be accessed HTTP only and if the user tries to access the page via HTTPS it will redirect them to the HTTP version of that page. I have tried several .htaccess files but I cannot seem to get any of them to work.

The name of the 3 pages that should be accessed via HTTPS are: enroll.php, payment.php, Registered.php

share|improve this question

1 Answer 1

Assuming that all of those pages are in the document root directory, and so is the .htaccess file:

RewriteCond %{HTTPS} =on
RewriteRule !^(enroll\.php|payment\.php|registered\.php)$ http://www.example.com/$1 [R=301]

RewriteCond %{HTTPS} =off
RewriteRule ^(enroll\.php|payment\.php|registered\.php)$ - [F]

Mind the capitalization - I've lowercased your Registered.php, but if that's not correct you'll want to fix.

Also, I have your redirect-to-HTTPS failing. Intentionally. The reason for this is that if you depend on the redirect to catch places where you've got your code sending requests to the unencrypted address, then your clients will be sending sensitive data in non-secure requests. Do not redirect it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.