Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have searched through all the redirects posted buy others and cant quite find the answer to my problem.

I have a website with over 3000 pages and we are getting duplication issues within google.

We want to keep everything in the parent directory to be http except our contact.php and login.php page.

We then have 3 folders that must be secured. admin, clients, customers

I have tried using the following code in seperate .htaccess files for each folder, but I keep getting a conflict when I try and I am still trying to find a good solution for the home directory.

RewriteEngine On 
RewriteCond %{SERVER_PORT} 80
RewriteCond %{REQUEST_URI} admin
RewriteRule ^(.*)$ https://www.website.com/$1 [R,L]

Any help would be greatly appreciated.

share|improve this question
1  
Can you clarify what you mean by "solution for the home directory"? And what do you mean by "getting a conflict when I try"? If you use that rule within a subdirectory's .htaccess file, then it'll strip that path out of the redirected URL - is that intended? –  Shane Madden Apr 11 '12 at 21:57
    
I am not good with .htaccess files. Im just looking for some direction. Is it best to place a https redirect for all containing files in each of the subdirectories or should it be handled within the parent directory. And I cant quite figure out how to redirect all files within the parent directory to http without also forwarding the contact and login page. –  Douglas Cottrell Apr 11 '12 at 22:08
    
Do you have access to your apache configuration files or do you have to do all this configuration in .htaccess files? –  Andre Lackmann Apr 12 '12 at 2:14
add comment

2 Answers

Don't try to control the protocol on a file by file basis. What you need is two distinct directory trees, one for http and the other for https, although the later may be a sub-directory of the former. Once you have the appropriate structure you redirect any http call for a secured page or directory to the appropriate place in the https tree.

share|improve this answer
add comment

I'd use a blacklist/whitelist idea, split into two separate directive blocks.

For all requests to HTTP-80, match those directories or paths that MUST be HTTPS and redirect them, all the rest will pass thru and be served correctly. This code assumes they are top level directories.

For your HTTPS-443 requests, do the opposite. If the requests DON'T match the allowed lists, then redirect back to HTTP

RewriteEngine On

# redirect to https where appropriate
RewriteCond %{SERVER_PORT} 80
RewriteCond %{REQUEST_URI} ^/(admin|clients|customers) [OR]
RewriteCond %{SCRIPT_FILENAME} (contact.php|login.php)
RewriteRule ^(.*)$ https://test.dev/$1 [R=301,L]

# handle SSL requests, flick anything that doesn't match allowed back to non-SSL 
RewriteCond %{SERVER_PORT} 443
RewriteCond %{REQUEST_URI} !^/(admin|clients|customers)
RewriteCond %{SCRIPT_FILENAME} !(contact.php|login.php)
RewriteRule ^(.*)$ http://test.dev/$1 [R=301,L]
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.