Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want users that visit my site to be redirected to the SSL version when they access it like this

www.mysite.com

But when they access other urls, such as...

www.mysite.com/some
www.mysite.com/other
www.mysite.com/links

That it goes to the normal version.

This is what i have so far that DOESNT work:

RewriteCond %{HTTP_HOST} ^mysite\.com$ [NC]
RewriteRule ^(.*)$ https://www.mysite.com/$1 [L,R=301]

This does it for ALL pages.

share|improve this question

migrated from stackoverflow.com Oct 12 '09 at 11:20

This question came from our site for professional and enthusiast programmers.

2 Answers 2

up vote 4 down vote accepted

You current ruleset is only checking the HTTP_HOST. To identify requests for your frontpage, you need to add checks for the REQUEST_URI:

RewriteCond %{HTTP_HOST} ^mysite\.com$ [NC]
RewriteCond %{REQUEST_URI} ^$ [NC, OR]
RewriteCond %{REQUEST_URI} ^/node$ [NC, OR]
RewriteCond %{REQUEST_URI} ^/yourFrontpageAlias$ [NC]
RewriteRule ^(.*)$ https://www.mysite.com/$1 [L,R=301]

This would also check for an empty request URI, for the standard Drupal frontpage 'node' and an alias you might have given it. This is just an untested example. If you've changed your default frontpage, you need to substitute 'node' with that one. Also make sure to test for trailing slash situations - depending on your setup, you'd need to allow matching those also.

You should probably also add a check of the HTTPS Server variable and skip the rule, if the request is for https already. It will contain 'on' or 'off' accordingly.

If you want to force other pages to explicit non ssl, you need to add a rule redirecting to non ssl for all other cases as well.

In addition to the standard mod_rewrite documentation page linked above, you might want to check the examples/explanations of the URL Rewriting Guide.


Also note that depending on your setup, you might not need/want to check the HTTP_HOST at all, e.g. you might have different hosts pointing to your instance (now or in the future - a common example would be 'www.mysite.com', which your current setup would ignore).

share|improve this answer

Check out the Drupal securepages module: http://drupal.org/project/securepages

Cheers

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.