Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I only want to have 3 pages able to be accessed via HTTPS. All other pages should be accessed HTTP only and if the user tries to access the page via HTTPS it will redirect them to the HTTP version of that page. I have tried several .htaccess files but I cannot seem to get any of them to work.
The name of the 3 pages that should be accessed via HTTPS are: enroll.php, payment.php, Registered.php
Assuming that all of those pages are in the document root directory, and so is the .htaccess file:
RewriteCond %{HTTPS} =on
RewriteRule !^(enroll\.php|payment\.php|registered\.php)$ http://www.example.com/$1 [R=301]
RewriteCond %{HTTPS} =off
RewriteRule ^(enroll\.php|payment\.php|registered\.php)$ - [F]
Mind the capitalization - I've lowercased your Registered.php, but if that's not correct you'll want to fix.
Also, I have your redirect-to-HTTPS failing. Intentionally. The reason for this is that if you depend on the redirect to catch places where you've got your code sending requests to the unencrypted address, then your clients will be sending sensitive data in non-secure requests. Do not redirect it.
