.htaccess: enabling "forcing https" and "suppressing the www." does not remove subdomain about server-configs-apache HOT 8 CLOSED

The visitor is not redirected from www.example.com to https://example.com, as I would have expected.

the http redirect example has:

RewriteCond %{HTTPS} !=on

Which excludes https requests. I'm not exactly sure why it looks like it's always been like that.

For info/reference, if it's a single-domain server, and you want to force https://example.com you would ordinarily have only 2 rules:

• not https -> https://example.com
• wrong domain -> https://example.com

i.e.

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteRule ^ http://example.com%{REQUEST_URI} [R=301,L]
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_HOST} !^example\.com$ [NC]
    # RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC] # if one-domain but using subdomains
    RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
</IfModule>

Or simply:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} !=on  [OR]
    RewriteCond %{HTTP_HOST} !^example\.com$ [NC]
    RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
</IfModule>

With the rules in your last comment there are more redirects than you mention for the second example:

http://www.example.com -> http://example.com -> https://example.com

I'll check if there's a reason that www redirect isn't schema-relative.

from server-configs-apache.

For example, changing the subdomain removal to this:

# Option 1a: rewrite www.example.com → example.com

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L]
</IfModule>

# Option 1b: rewrite https://www.example.com &#8594; https://example.com

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} on
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
</IfModule>

Does produce the behaviour I expected. Now this might be a very inefficient way to do this and there might be a more compact way, but it does what I expected initially:

http://example.com -> https://example.com
http://www.example.com -> https://example.com
https://www.example.com -> https://example.com

So I'm wondering why there is an explicit check for https and a rewrite to an unsecured domain in the rewrite rule that's currently in h5bp's htaccess. If possible, wouldn't it be better to make it protocolless? It seems like it's possible to rewrite both http: and https:

from server-configs-apache.

Ok, well this:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} !=on  [OR]
    RewriteCond %{HTTP_HOST} !^example\.com$ [NC]
    RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
</IfModule>

makes sense, but is it necessary to specify the domain (example.com) manually? Because that might be the reason to not make it the default (less configuration required).

If it could be simplified to work without having to specify the domain then I don't see why that shouldn't be the default.

from server-configs-apache.

And I guess that the inefficiency of

http://www.example.com -> http://example.com -> https://example.com

is the drawback of the modularity of the rules (i.e. they allow you to force https without forcing subdomain removal or vice versa), which I don't mind. I'd rather have the modularity than the efficiency.

from server-configs-apache.

is it necessary to specify the domain (example.com) manually?

No, I wrote it that way purely for clarity.

from server-configs-apache.

Ok I see. Btw. if I'm not mistaken, this would be the rewrite for both http and https (courtesy of stack overflow):

# Option 1: rewrite www.example.com → example.com

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_HOST}#%{HTTPS}s ^www\.([^#]+)#(?:off|on(s)) [NC]
    RewriteRule ^ http%2://%1%{REQUEST_URI} [R=301,L]
</IfModule>

For me this worked as expected.

from server-configs-apache.

RewriteEngine On

RewriteCond %{HTTPS} =off [OR]
RewriteCond %{HTTP_HOST} !^www. [OR]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /index.(html|php)
RewriteCond %{HTTP_HOST} ^(www.)?(.+)$
RewriteRule ^(index.(html|php))|(.*)$ https://www.%2/$3 [R=301,L]

from server-configs-apache.

this is not working when i try to redirect https://www.example.com to https://example.com. Can you please help

from server-configs-apache.