HTTP Not Redirecting to HTTPS: How to Force Secure Traffic

Short answer: when visitors type your domain without typing https://, browsers default to insecure HTTP unless your web server or DNS proxy forces a 301 redirect to HTTPS. To fix this, enable "Always Use HTTPS" in Cloudflare, add a redirect block in Nginx, or insert a rewrite rule into your Apache .htaccess file.

Leaving port 80 open without a redirect means search engines index two separate versions of your pages, login forms transmit credentials in plain text, and visitors see an insecure warning. If your certificate is already installed and working on HTTPS, setting up the redirect takes only two minutes.

Step 1: test your current HTTP response code

Before changing files, see exactly how your server answers a plain HTTP request. Open your terminal and run this curl command against your domain:

curl -I http://example.com/

Look at the very first line of the output:

• HTTP/1.1 200 OK: your server serves the page over insecure HTTP. No redirect is in place.
• HTTP/1.1 301 Moved Permanently or 308 Permanent Redirect: your server redirects to another URL. Check the Location: header in the response. It should begin with https://example.com/.
• HTTP/1.1 302 Found: a temporary redirect exists. You should change this to a permanent 301 redirect so search engines pass ranking signals to the secure URL.

If you also support subdomains or www, repeat the test for http://www.example.com/ to confirm both variants redirect cleanly, matching your WWW vs non-WWW settings.

Step 2: enable the redirect at your CDN or DNS proxy

If you run Cloudflare or another reverse proxy in front of your origin host, the easiest place to redirect traffic is at the edge before it ever reaches your server.

In the Cloudflare dashboard:

1. Navigate to SSL/TLS and click Edge Certificates.
2. Scroll down to Always Use HTTPS and toggle the switch to On.
3. Next, check your SSL encryption mode under SSL/TLS -> Overview. Make sure it is set to Full (strict). If it is set to Flexible, your server and Cloudflare will fight each other and trigger a redirect loop.

Cloudflare immediately answers any request on port 80 with a 301 redirect pointing to the equivalent https:// address.

Step 3: configure Nginx to redirect HTTP traffic

If you manage your own virtual private server running Nginx, configure a dedicated server block listening on port 80.

Open your site configuration file (typically in /etc/nginx/sites-available/ or /etc/nginx/conf.d/):

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    root /var/www/html;
    index index.html index.php;
    # your application configuration continues below
}

Test the configuration syntax and reload the service:

sudo nginx -t
sudo systemctl reload nginx

The $request_uri variable ensures that deep links like http://example.com/about/team redirect directly to https://example.com/about/team without losing query parameters or sub-paths.

Step 4: configure Apache via .htaccess or VirtualHost

On Apache web servers or shared cPanel hosting, you can force HTTPS through mod_rewrite rules inside your root .htaccess file.

Place these lines at the very top of your .htaccess file, right above any WordPress or framework rules:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

If your host sits behind a load balancer or reverse proxy that terminates SSL before reaching Apache, the %{HTTPS} variable might appear off even when the user arrived over HTTPS. In that specific setup, check the forwarded protocol header instead:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

Step 5: check for mixed content and internal links

Redirecting page URLs is only half the battle. If your HTML templates still load stylesheets, scripts, or images with http:// prefixes, visitors will encounter mixed content errors.

Update your site URL in your content management system settings:

• In WordPress, open Settings -> General and make sure both WordPress Address (URL) and Site Address (URL) start with https://.
• Run a search and replace on your database to convert any hardcoded internal HTTP links to HTTPS.
• Use your browser developer tools (press F12, open the Console tab) and verify there are no active mixed content warnings.

Common mistakes

• Using a 302 temporary redirect instead of 301: search engines will keep crawling and indexing the insecure HTTP version because 302 tells them the change is temporary.
• Redirecting before an SSL certificate is active: if your certificate has expired or is not installed, visitors who are redirected to HTTPS will hit a scary browser error screen. Verify your certificate first.
• Creating redirect loops with Flexible SSL: having Cloudflare set to Flexible while your origin server forces HTTPS causes an infinite loop because Cloudflare connects to your origin on HTTP.
• Losing the path on redirect: redirecting all incoming HTTP URLs to the homepage https://example.com/ instead of preserving the requested path breaks incoming links and bookmarks. Always include the original request URI.