Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 3 pages that I want to make secure on my website using .htaccess

-login.php
-checkout.php
-account.php

I know how to make just one work page at a time using .htaccess

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} /login.php
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L]

I and trying to figure out how to include the other 2 specific pages to make them also secure and used the expression below but it didn't work

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} /login.php
RewriteCond %{REQUEST_URI} /checkout.php
RewriteCond %{REQUEST_URI} /account.php
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L]

Can someone help me the right expression that will work with multiple pages?

The second part of the code is that, if https is already on and a user move to a page that Is not any of the pages i specified about, I want that it should get back to http. how should I write the statement for it to redirect back to http if its not any of the pages above?

I have my statement like this but its not working

RewriteCond %{HTTPS} on 
RewriteRule !(checkout|login|account|payment)\.php http://%{HTTP_HOST}%{REQUEST_URI} [L,R]

Any thoughts?

share|improve this question

migrated from stackoverflow.com Oct 6 '12 at 1:20

This question came from our site for professional and enthusiast programmers.

add comment

1 Answer

Try:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (login|checkout|account)\.php https://%{HTTP_HOST}%{REQUEST_URI} [L]

Conditions are logically *AND*ed together, so your ruleset won't work unless the URI has all 3 matches in it (like: /something/login.php/account.php/path/checkout.php)

share|improve this answer
    
@PatrickNdille What you have in that comment should work, if you remove the #'s –  Jon Lin Oct 5 '12 at 18:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.