Trying to force WWW and HTTPS and only two out of my three rules will work

Question

Not working for me .. what am I doing wrong I get the dreaded too many redirects error. I am trying to force all my urls to WWW and https, though I would settle for just being able to force everything to https

    RewriteEngine on
    RewriteBase /

    RewriteCond %{http_host} ^all-service-musical.com [nc]
    RewriteRule ^(.*)$ https://www.all-service-musical.com/$1 [r=301,nc]

    RewriteCond %{http_host} ^asmusic.org [nc]
    RewriteRule ^(.*)$ https://www.all-service-musical.com/$1 [r=301]

    RewriteCond %{http_host} ^www.all-service-musical.com [nc]
    RewriteRule ^(.*)$ https://www.all-service-musical.com/$1 [r=301,nc]

The first two rules work fine together, but the 3rd rule to try to change the www url to https breaks the whole thing.... any ideas?

I also tried removing all the above code and tried to accomplish the http to https portion of the task by using:

RewriteEngine On
#RewriteCond %{HTTPS} off
#RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

I also get a too many redirects error also when using the above approach.

I as well tried this alone by itself:

RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://all-service-musical.com/$1 [R,L]

Same results ... breaks the site with too many redirects error.

MrWhite ...Thank you for taking the time to answer, the code that is currently in the htaccess file is:

RewriteEngine on
RewriteBase /
RewriteCond %{http_host} ^www.all-service-musical.com [nc]
RewriteRule ^(.*)$ https://all-service-musical.com/$1 [r=301,nc]

RewriteCond %{http_host} ^asmusic.org [nc]
RewriteRule ^(.*)$ https://all-service-musical.com/$1 [r=301]

RewriteCond %{http_host} ^www.asmusic.org [nc]
RewriteRule ^(.*)$ https://all-service-musical.com/$1 [r=301] 

As the certificate is for all-service-musical.com ( I am beginning to wonder if setting it up that way was bad advice from the hosting company) I thought I would try rewriting the code so that the non WWW version is the target, however I still have the same issue of when I type all-service-musical.com into the address bar it comes up as unsecured, when I had the code as originally posted the the WWW version when typed directly would come up as unsecured.

I would have to think that this bit of code you provided:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=302,L]

If everything else is removed should work all on its own to a certain extent, but it breaks the site with a too many redirects error even when it is the only thing in the htaccess file.

I do like and appreciate your advice on using a 302 redirect until I get the right code figured out for this. Any further advise on where my issue may be lurking is greatly appreciated.

Answer 1

If you are persistently getting redirect loops when trying all of these directives then clear your browser cache. All these shouldn't be triggering redirect loops. It is advisable to test with 302 (temporary) redirects for this reason, and only change to 301 (permanent) when you are sure they are working OK.

RewriteCond %{http_host} ^all-service-musical.com [nc]
RewriteRule ^(.*)$ https://www.all-service-musical.com/$1 [r=301,nc]

RewriteCond %{http_host} ^asmusic.org [nc]
RewriteRule ^(.*)$ https://www.all-service-musical.com/$1 [r=301]

RewriteCond %{http_host} ^www.all-service-musical.com [nc]
RewriteRule ^(.*)$ https://www.all-service-musical.com/$1 [r=301,nc]

Your first three RewriteRule directives are all missing the L flag, so processing will continue onto the next rule etc. Your 3rd rule that tries "to change the www url to https" will certainly result a redirect loop as you are simply redirecting to itself. To redirect from HTTP to HTTPS, you need to first check for HTTP (ie. HTTPS is off), as you are doing in your later attempts.

RewriteEngine On
#RewriteCond %{HTTPS} off
#RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Your 4th rule redirects to HTTPS on the same host - this is potentially a good idea, providing your different domains (do you have just two?) all have a security cert installed.

RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://all-service-musical.com/$1 [R,L]

This is redirecting to the domain apex, not the www subdomain (the opposite of the first three rules). This could potentially result in a redirect loop if the site code itself issued a redirect to the canonical host.

Assumptions:

• You have a single canonical hostname www.all-service-musical.com and all other domains redirect to this.
• The SSL cert is installed directly on your application server and not managed by a front-end proxy.
• You are not implementing HSTS. (If you are you would need to redirect to HTTPS on the same host first and ensure you have a SSL cert installed on each domain.)

Try the following instead, near the top of your .htaccess file:

RewriteEngine On

# Redirect non-canoncial hostname
RewriteCond %{HTTP_HOST} !^www\.all-service-musical\.com$
RewriteRule (.*) https://www.all-service-musical.com/$1 [R=302,L]

# Redirect to HTTPS
# NB: This only applies if the canonical hostname is requested over HTTP
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=302,L]

As mentioned above, only change the 302 to 301 once you have confirmed it works OK - to avoid issues with the browser cache.