I asked our web host to setup SSL on our web site, such that HTTP requests will automatically redirect to HTTPS.

They say this is done, however when accessing the site via HTTP I now get:

Response HTTP/1.1 403 Forbidden

HTTPS works fine.

I asked for this to be corrected and I've been told this is not a server setting (which they manage) and needs to be fixed via web.config (which I have access to).

I've tried unsuccessfully to use the following changes to catch this 403 and redirect it:

    <customErrors defaultRedirect="/test.html" mode="On"></customErrors>

<httpErrors errorMode="Custom">
    <remove statusCode="403" subStatusCode="-1" />
    <error statusCode="403" prefixLanguageFilePath="" path="/test.html" responseMode="ExecuteURL" />

How can I resolve this such that HTTP will redirect to - effectively requiring - HTTPS?


Turns out the host had to first uncheck "Require SSL", then I was able to redirect traffic in web.config via:

<rule name="HTTP to HTTPS redirect" stopProcessing="true">
  <match url="(.*)" />
      <add input="{HTTPS}" pattern="off" ignoreCase="true" />
 <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" />
  • 1
    Note, this requires the IIS Url Rewrite module to work. – cde Feb 14 '17 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.