Force HTTPS in cPanel: .htaccess Redirect Without Loops

You installed an SSL certificate, the padlock shows up when you type https:// by hand, but visitors who land on http://yoursite.com still get the old, unencrypted version. Google sees two copies of every page, and browsers keep calling the site "Not Secure". The missing piece is a redirect that pushes every HTTP request to HTTPS. It's a five-minute job, but it's also where a lot of people accidentally create a redirect loop. Here's how to do it cleanly on cPanel and on a VPS.

Symptom: HTTPS works, but HTTP never moves

• Typing http://example.com keeps you on HTTP with a "Not Secure" label.
• Search results show both HTTP and HTTPS versions of the same URL.
• Only the home page redirects, inner pages don't (or the other way round).
• After you add a redirect, the browser shows ERR_TOO_MANY_REDIRECTS.

Cause: a certificate isn't a redirect

Installing SSL only makes port 443 answer with an encrypted connection. Port 80 keeps serving the site exactly as before until you tell the server to send those visitors elsewhere. So you need an explicit rule, and it has to run before your CMS gets involved.

Before you start: confirm HTTPS really works

Don't redirect to a broken HTTPS site. Check these first:

1. Open https://example.com and https://www.example.com. Both should load without a certificate warning.
2. In cPanel, open SSL/TLS Status and make sure the domain and its www name both show a valid certificate.
3. Take a copy of your current .htaccess (File Manager → right-click → Copy) so you can roll back in seconds.

Fix 1: the one-click option in cPanel

On many accounts the quickest route is Domains → Domains in cPanel. Find your domain and flip the autossl-failures-not-secure-browser-warnings" class="auto-link">Force HTTPS Redirect toggle on. cPanel writes the rule for you, and flipping it off removes it again. If your account doesn't show the toggle, use the manual method below.

Fix 2: the .htaccess rule (Apache / LiteSpeed)

Open public_html/.htaccess in File Manager (turn on Show Hidden Files in Settings if you can't see it). Put this at the very top, above the WordPress block or any other rules:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

That sends any request that isn't already HTTPS to the same host and path over HTTPS, using a permanent 301 so search engines transfer ranking to the secure URLs.

Combining it with a www redirect

If you also want everything on one hostname, do it in a single hop. Two chained redirects (HTTP → HTTPS → www) work, but they're slower and some crawlers complain. This version forces HTTPS and the non-www name together:

RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

Swap example.com for your real domain. If you'd rather keep www as the canonical name, reverse the logic.

Fix 3: Nginx on a VPS

On Nginx, don't use if rewrites. Give port 80 its own tiny server block that does nothing but redirect:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

Then test and reload:

nginx -t && systemctl reload nginx

Make sure your listen 443 ssl block exists separately and has the certificate paths. Certbot users: running certbot --nginx normally adds this redirect for you.

The redirect loop trap (Cloudflare and proxies)

This is the number one reason a correct-looking rule breaks a site. If your domain sits behind Cloudflare or a load balancer, the connection from that proxy to your server may be plain HTTP even though the visitor used HTTPS. Your server sees "not HTTPS", redirects, the proxy fetches again over HTTP, and round it goes.

The fixes, in order of preference:

• In Cloudflare, set SSL/TLS mode to Full (strict), never Flexible, once your origin has a valid certificate.
• If you must keep a proxy that talks HTTP to the origin, check the forwarded header instead:

RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

WordPress needs its own fix too

A redirect handles the visit, but WordPress still stores old http:// links in the database. That causes mixed-content warnings where images or scripts load insecurely. After the redirect works:

1. Go to Settings → General and change both WordPress Address and Site Address to https://.
2. Run a search-replace on the database. With WP-CLI: wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-run, then run it again without --dry-run.
3. Clear any caching plugin and the CDN cache.

If wp-admin locks up in a loop after the change, the culprit is usually a leftover FORCE_SSL_ADMIN or a plugin adding a second redirect. Remove duplicates so only one layer is doing the job.

How to test it properly

Browsers cache 301 redirects aggressively, so a normal reload can lie to you. Use curl:

curl -I http://example.com
curl -I http://www.example.com/some-page/

You want exactly one 301 response with a Location: header pointing to the HTTPS version, then a 200 at the final URL.

Prevention

• Keep one redirect layer. Pick cPanel toggle, .htaccess, a plugin, or Cloudflare rule, and remove the rest.
• Always keep a backup copy of .htaccess before editing.
• Once everything is stable for a few weeks, consider adding HSTS, but test first since it's hard to undo.
• Resubmit your HTTPS sitemap in Google Search Console after the switch.

Frequently Asked Questions

Should I use a 301 or a 302 redirect for HTTPS?

Use a 301. It's permanent, so search engines treat the HTTPS URL as the real one. A 302 is for temporary moves and can slow down consolidation of your rankings.

Will forcing HTTPS hurt my SEO?

Not if it's done as a single 301 hop. Rankings normally carry over, and HTTPS is a small positive signal. Just update internal links, canonical tags and your sitemap.

Do I need a plugin to force HTTPS on WordPress?

No. A server-level rule is faster and more reliable than a plugin. Use a plugin only if you can't edit .htaccess or the server config.

Why does my site still show "Not Secure" after the redirect?

Almost always mixed content: some images, scripts or fonts are still requested over http://. Open the browser console, find the insecure URLs, and update them in your theme or database.

I broke my site by editing .htaccess. What now?

Rename the file to .htaccess-bad or restore your backup copy. The site comes back immediately, and you can re-add the rule one line at a time. If you're stuck, SkyServer support can take a look at the error log with you.