Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Apache 2.2 server with an SSL certificate hosting several services that should be only access using SSL.

ie: should be allowed while should be either denied or, ideally, redirected to https. should not have this restriction, and should work using either http or https.
The decision to allow/deny http is made at the top level directory, and affects all content underneath it.

Is there a directive that can be placed in the Apache config to retrict access in this manner?

share|improve this question

migrated from Sep 18 '12 at 20:59

This question came from our site for professional and enthusiast programmers.

up vote 24 down vote accepted

The SSLRequireSSL directive is what you're looking for, for example:

<Directory /topsecret>
share|improve this answer
Thanks, that did the trick nice and easily. – DrStalker Sep 19 '08 at 1:35
Welcome to Server Fault! We really do prefer that answers have content, not pointers to content. This may theoretically answer the question however, it would be preferable to include the essential parts of the answer here, and provide the link for reference. Thank you! – Chris S Apr 11 '13 at 18:41
Ok, I've updated my five-year-old post with an example :) – Thomas Jul 1 '13 at 17:55
To be fair, 5 years old or not, the reasoning is that the link you point to might disappear, making your answer mostly or completely useless to somebody coming along looking for the information later. So I actually voted your snarky comment up (honest), but I also totally agree that the answer should have some context so that it remains useful. Especially since it's marked as the correct answer. – Craig May 22 '15 at 20:52
I don't think the SO/SF community was as strict about just-a-link and "lmgtfy" answers back then. But I agree; a retroactive edit makes sense at any time. – Thomas May 26 '15 at 18:11

In the global configuration you could use:

<IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteCond %{HTTPS} !on
   RewriteRule .* https://%{HTTP_HOST}/%{REQUEST_URI} [R=301,L,QSA]

Similarly you could use a .htaccess file in the first directory of the secure directory tree:

<IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteCond %{HTTPS} !on
   RewriteRule .* https://%{HTTP_HOST}/%{REQUEST_URI} [R=301,L,QSA]

That last one could also be placed inside a directory directive in the global or virtual host configuration.

share|improve this answer
Redirecting HTTP to HTTPS opens you up to certain types of MiTM attacks. Just a caution. – Craig May 22 '15 at 20:53

Assuming you are using VirtualHost directives,

Place a Directory directive in the non-ssl virtualhost denying access.

Then, place a Directory directive in the ssl virtualhost granting access.

share|improve this answer

maybe even:if($_SERVER['SERVER_PORT'] != 443){ header('Location:'); }

share|improve this answer

I've always done this mod_rewrite in an .htaccess file, though you should be able to do it within your main config file as well.

Here's a guide with a few ways of making this happen: Smart HTTP and HTTPS RewriteRule Redirects

share|improve this answer

Alternatively, you could use the server-side language to do the processing for you, rather than using Apache's configuration options (if, perhaps, you don't have access to the server's configuration).

For example, with PHP:

if (!isset($_SERVER['HTTPS'])) {
  // put your redirect here

(though just be aware - if you're using ISAPI on Microsoft IIS, if the request is not being routed through HTTPS, then the value of the $_SERVER['HTTPS'] variable will be "off")

share|improve this answer

Someone mentioned SSLRequireSSL but I don't think it works by itself and I haven't found a successful example with it. The recommended way is I've applied that and it works well!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.