Redirect Apache HTTP Traffic to HTTPS Without Creating Loops

An HTTP-to-HTTPS redirect is useful only after HTTPS works for the intended hostname. Back up the existing configuration and test with a temporary redirect before making it permanent. Installing a certificate and configuring redirects are separate tasks.

Choose the right layer

Prefer the hosting panel’s supported redirect control or an administrator-managed HTTP virtual host when available. Use .htaccess only where Apache permits the required overrides and no panel/CDN/application rule already performs the same redirect.

Direct-to-Apache example

This example is for a document-root .htaccess where Apache directly terminates HTTPS. Replace the fixed destination with your chosen, certificate-covered hostname and place the rule before application front-controller rules. It preserves the request path and existing query string:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=302,L]

The fixed hostname avoids building a redirect from an arbitrary Host header. Test ordinary pages, nested paths, query strings and required validation endpoints. Once verified, change R=302 to R=301 if a permanent redirect is intended; cached permanent redirects can complicate rollback.

Reverse-proxy warning

Do not use this direct-TLS test unchanged behind a TLS-terminating proxy: Apache may see HTTP even when the visitor used HTTPS, creating a loop. Have the administrator configure the appropriate trusted-proxy scheme handling. Trust forwarded headers only from a controlled proxy that overwrites them; do not blindly accept a client-supplied scheme header.

Check more than the homepage

Check the destination certificate, the redirect chain and the application’s canonical URLs. A redirect does not rewrite hardcoded external resources or guarantee that another host supports HTTPS. Avoid broad authentication/security exceptions for certificate validation; diagnose the exact validation path. Retain a recovery route if application login or payments fail.

Reference: Apache redirect and proxy-scheme guidance.

Reviewed October 15, 2026. The example is checked in an isolated Apache fixture; no production rewrite or proxy setting was changed.