Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using the rewrite rules below to redirect 2 php pages to https (to protect user data), but whenever I click on any links on those php pages they redirect with https enabled and the page does not display correctly.

The rules at the bottom were meant to redirect any other pages back to http, but they are not working. Any advice would be much appreciated!

    RewriteEngine on
    RewriteCond %{HTTPS} off
    RewriteCond %{REQUEST_URI} ^/securepage1.php$ [NC]
    RewriteRule ^(.*)$$1 [L,R=301]

    RewriteCond %{HTTPS} off
    RewriteCond %{REQUEST_URI} ^/securepage2.php$ [NC]
    RewriteRule ^(.*)$$1 [L,R=301]

    RewriteCond %{HTTPS} on
    RewriteCond %{REQUEST_URI} !^/securepage1.php$ [NC]
    RewriteCond %{REQUEST_URI} !^/securepage2.php$ [NC]
    RewriteRule ^(.*)$$1 [L,R=301]
share|improve this question

Try enabling logging to get a clear idea of what steps are failing:

RewriteLog /path/to/log
RewriteLogLevel 2

You can use values greater than 2 for the log level, but keep in mind that this will affect your server's performance, so be wary of running this on a heavy production instance.

Now, for some security thoughts. If you're worried enough to protect the data on specific pages (but not others), then the best question to ask is: is it worth making only 2 pages on your site trust-worthy? If I navigate to and get intercepted in a Man In the Middle (MIM) attack, does your user really care if is secure when the MIM attack has me going to In other words, if this is part of an interactive site, protecting the two secure pages does nothing because the user can't actually trust the site from the start.

share|improve this answer
Well, the main page is just regular content with links that go to the secure pages which are registration pages where users enter in their data. – user1684850 Jan 4 '13 at 22:26
Right, so the user logs in, gets a cookie set--and then goes back to a non-secure page, right? That cookie then gets sent over unencrypted channels--which means anybody could take it and become that user. It's a massive security hole. – Andrew M. Jan 6 '13 at 16:48
No, there is no log-in required on this site. The SSL is just to protect basic user information on registration pages for particular events. – user1684850 Jan 7 '13 at 17:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.