How to use the http to https redirect generator
- Choose your server or platform from the dropdown menu.
- Enter your domain name, for example example.com. A pasted URL or a leading www is cleaned up for you, and the domain is used in every option except the plain Apache and IIS HTTPS rules.
- Select whether to force www, force non-www, or keep both hostnames as they are.
- Copy the generated snippet and paste it into your
.htaccess,nginx.conf,web.config, or platform dashboard.
How the Apache .htaccess redirect works
To set up an apache redirect http to https, you use the mod_rewrite module inside your .htaccess file. The generated rule checks whether the request arrived without TLS with RewriteCond %{HTTPS} off and then sends it to the same host and path over HTTPS.
The core directive is RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]. The R=301 flag makes the redirect permanent, so browsers and search engines update their cached URLs, and the L flag stops further rewrite processing for that request. Apache appends the original query string automatically.
If you also choose to force the www or non-www hostname, a first rule matches the unwanted host with RewriteCond %{HTTP_HOST} ^example\.com(:[0-9]+)?$ [NC] and sends it straight to the canonical host over HTTPS. That avoids a redirect chain, because the request reaches the final URL in one hop.
Behind a load balancer or CDN that terminates TLS, %{HTTPS} is always off at the origin, which causes a redirect loop. The generated file includes a commented X-Forwarded-Proto condition to use in that case.
Nginx server block configuration
Nginx handles an http redirect to https with a dedicated server block on port 80 that does nothing except return 301 to the HTTPS URL. Your existing block that listens on port 443 with SSL enabled keeps serving the actual content.
The port 80 block lists both example.com and www.example.com in server_name, so it does not capture traffic for other sites on the same server. Without a canonical hostname it redirects to https://$host$request_uri. When you force www or non-www, the port 80 block and an extra port 443 block for the unwanted host both redirect straight to the canonical URL, for example return 301 https://example.com$request_uri;, so the visitor reaches the final address in a single response. The extra 443 block needs the same certificate directives as any other SSL server, which the output shows as placeholders.
| Directive | Purpose |
|---|---|
listen 80; | Catches plain HTTP traffic |
server_name example.com www.example.com; | Limits the redirect to your own hostnames |
return 301 | Sends a permanent redirect response |
$request_uri | Preserves the original path and query string |
IIS web.config URL Rewrite rules
To configure an iis redirect http to https, you need the URL Rewrite module installed on your Windows server. The rule lives inside the <system.webServer> section of your web.config file.
The match element uses url="(.*)" to capture the entire request path. A condition checks {HTTPS} against the pattern off. When both match, the action redirects to https://{HTTP_HOST}/{R:1} with redirectType="Permanent", which sends a 301 status. The query string is appended automatically.
If you choose a canonical hostname, a first rule matches the unwanted host with a {HTTP_HOST} condition and redirects it directly to the canonical HTTPS URL, so the visitor only sees one redirect. IIS evaluates these rules before your application code runs.
CDN and edge platform approaches
Platforms like Cloudflare, Netlify and Vercel handle TLS at the edge, so the method to redirect from http to https differs from traditional servers.
On Cloudflare, enable "Always Use HTTPS" under SSL/TLS, Edge Certificates; it needs no rules. Keep the encryption mode on Full or Full (strict), because Flexible mode can create a loop if your origin also redirects. For a canonical hostname, create a Redirect Rule that matches the unwanted host and uses a dynamic expression such as concat("https://www.example.com", http.request.uri.path) with status 301 and the query string preserved.
Netlify redirects HTTP to HTTPS on its own once HTTPS is enabled for the domain. In a _redirects file in your publish directory you can also write host-specific rules such as http://example.com/* https://example.com/:splat 301!. The exclamation mark forces the rule even when a file exists at that path. Do not write a catch-all /* https://example.com/:splat 301! rule, because it would redirect HTTPS requests to themselves.
Vercel redirects HTTP to HTTPS for every domain automatically. Its vercel.json redirects array is only needed for hostname changes, such as sending the apex domain to www. Using statusCode: 301 gives a 301, whereas permanent: true sends a 308.
Common mistakes when redirecting to HTTPS
A frequent error is creating a redirect loop. This happens when your origin server redirects HTTP to HTTPS, but a load balancer or CDN terminates TLS and forwards the request to the origin as HTTP again. The origin sees a non-TLS request and redirects back, causing an infinite loop. To fix this, check for headers like X-Forwarded-Proto instead of relying solely on the connection protocol.
Another mistake is using a 302 temporary redirect instead of a 301 permanent redirect. Search engines treat 302s as temporary, so they continue indexing the HTTP version. Always use 301 when you intend the change to be permanent.
Finally, avoid redirect chains. If a visitor requests http://www.example.com/page, they should reach https://example.com/page in one hop. Chaining an HTTP-to-HTTPS redirect followed by a www-to-non-www redirect adds an extra round trip, which is why the generated rules redirect the unwanted host straight to the final URL.
Worked examples
| Example | Input | Result |
|---|---|---|
| Apache with www | Server or platform: apache; Domain name: example.com; Canonical hostname: www | File: .htaccess; Module required: mod_rewrite; Status code: 301 Permanent |
| Nginx non-www | Server or platform: nginx; Domain name: example.com; Canonical hostname: nonwww | File: nginx.conf or sites-available; Directive: return 301; Status code: 301 Permanent |
| IIS redirect http to https | Server or platform: iis; Domain name: example.com; Canonical hostname: none | File: web.config; Module required: URL Rewrite; Status code: 301 Permanent |
| Cloudflare simple redirect | Server or platform: cloudflare; Domain name: example.com; Canonical hostname: none | Location: Cloudflare Dashboard; Status code: 301 Permanent |
FAQ
What is the difference between a 301 and 302 redirect for HTTPS?
A 301 redirect is permanent, so search engines treat the HTTPS URL as the new address and index it. A 302 redirect is temporary, so engines may keep the HTTP URL. When you redirect http to https, use 301.
Do I need to redirect http to https on every page?
Yes. The redirect should apply to the entire site so that any HTTP request, regardless of path or query string, is sent to its HTTPS equivalent. The configurations generated here use wildcard patterns to cover all routes.
How do I test that my http redirect to https is working?
Use a command-line tool like curl with the -I flag to inspect the response headers, or use an online http headers checker. You should see a 301 status and a Location header pointing to the HTTPS URL.
Can I redirect from http to https without access to the server config?
If you cannot edit server files, you can often set up the redirect through your CDN or hosting dashboard. Cloudflare, Netlify and Vercel all provide interface-level controls for enforcing HTTPS.
Will forcing www cause problems with my SSL certificate?
Your SSL certificate must cover both the root domain and the www subdomain. Most modern certificates include both via a SAN entry. If yours does not, visitors redirected to www will see a certificate warning.
Does this tool upload my domain name to a server?
No. The configuration is generated entirely in your browser using JavaScript. Your domain name never leaves your device.