How to specify Multiple Secure Webpages with .htaccess RewriteCond

Question

I have 3 pages that I want to make secure on my website using .htaccess

-login.php
-checkout.php
-account.php

I know how to make just one work page at a time using .htaccess

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} /login.php
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L]

I and trying to figure out how to include the other 2 specific pages to make them also secure and used the expression below but it didn't work

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} /login.php
RewriteCond %{REQUEST_URI} /checkout.php
RewriteCond %{REQUEST_URI} /account.php
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L]

Can someone help me the right expression that will work with multiple pages?

The second part of the code is that, if https is already on and a user move to a page that Is not any of the pages i specified about, I want that it should get back to http. how should I write the statement for it to redirect back to http if its not any of the pages above?

I have my statement like this but its not working

RewriteCond %{HTTPS} on 
RewriteRule !(checkout|login|account|payment)\.php http://%{HTTP_HOST}%{REQUEST_URI} [L,R]

Any thoughts?

Answer 1

Try:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (login|checkout|account)\.php https://%{HTTP_HOST}%{REQUEST_URI} [L]

Conditions are logically ANDed together, so your ruleset won't work unless the URI has all 3 matches in it (like: /something/login.php/account.php/path/checkout.php)