Our site currently redirects requests sent to http://example.com to https://example.com -- everything beyond this is served over SSL. For now, the redirect is done with an Apache rewrite rule.

Our site is dealing with money, however, so security is pretty important. Does allowing HTTP in this way pose any greater security risk than just not opening or listening on port 80? Ideally, it's a little more user-friendly to redirect.

(I am aware that SSL is only one of a large set of security considerations, so please make the generous assumption that we have done at least a "very good" job of covering various security bases.)

2 Answers 2


You're doing the right thing by redirecting http to https (assuming you use 301 redirects).

One additional thing that you should strongly consider doing is enabling Strict Transport Security so that browsers know that this is a web site they should connect to only via https.

  • Thanks, and especially thanks for the link to HSTS, which is simple, and a great idea that I had no clue about. Yes, the redirect is a 301 :-) Sep 26, 2012 at 3:37

It actually can create a security issue if done incorrectly, but given that the biggest banks and financial firms in the world [effectively] do it for their online services, I think you're safe, or at least in good company.

Stack Overflow has an older thread on the topic, and as observed, you want to make sure that you enable HSTS, otherwise there are potential issues with MiTM attacks and potential session hijacking.

And, by the way, the recommended way to do this is with a VirtualHost rule rather than mod_rewrite.

  • Thanks as much as Michael, who beat you by a few minutes ;-). Any rewriting is done within a VirtualHost container (no .htaccess). While I read Apache's exhortation to use the simpler method, for the moment, I have a couple of related rewrites (e.g. domain canonicalization) that are more logically grouped as one set. Once we move this to our app and out of Apache, I can make the evil RewriteRule a bad memory :-) Sep 26, 2012 at 3:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.