Using .htaccess To Redirect HTTPS To HTTP

9th April 2009 - 4 minutes read time

To redirect from HTTPS to HTTP on the home page only using the following rule.

RewriteCond %{HTTPS} on
RewriteRule ^/?$ http://%{SERVER_NAME}/ [R=301,L]

The variable %{HTTPS} will be either "on" or "off" and will be enabled even if SSL is not installed on your site. The rule above sees that HTTPS is on and redirects the home page to the HTTP version. You can even chain lots of rules together like this.

RewriteCond %{HTTPS} on
RewriteRule ^/?$ http://%{SERVER_NAME}/ [R=301]
RewriteRule ^inner/directory/?$ http://%{SERVER_NAME}/inner/directory/ [R=301,L]

Note that you should end your last rule with L so that no other rules on the page are run. Also, you need to make absolutely sure that you are not redirecting any pages that are integral to the security of your shopping cart as this will turn off HTTPS for those pages.

You can also do the same thing using the ${SERVER_PORT} variable.

RewriteCond %{SERVER_PORT} 443
RewriteRule ^/?$ http://%{SERVER_NAME}/ [R=301,L]

The port for HTTPS is 443 so if the port being communicated through is 443 we need to redirect.

Comments

hi there,

I am trying to redirect https to http for the website coupon aid
I changed htaccess but it doesn't seem to work. Could you take a look and see what the problem is?

it's not redirecting :(

help needed

Mon, 05/16/2011 - 04:19

If it isn't redirecting then there are a couple of things you can try. The rules above require mod_rewrite being available on your Apache server, if it isn't on then the rules throw and error. There may be an issue with the expression you are using to redirect if you are trying to do it with an inner directory. Either way, any errors should be logged by your Apache server in the error.log so if nothing works that should point you in the right direction.

Phil Norton

philipnorton42

Mon, 05/16/2011 - 09:04
What if you use Nginx instead of Apache?

Mauro

Fri, 10/25/2013 - 00:05
I know this is an old thread, but I've just discovered that replacing http with https on my site redirects to a totally unrelated site (shared server). I successfully use htaccess to redirect from mysite.com to www.mysite.com but the above code isn't working.

Sean

Thu, 06/26/2014 - 11:51
please I need one only htaccess that: for website1 redirect from http to https and for others websites redirect from https to http and please for all websites redirect "without www" to www can you help me? Thanks a lot

Fulvio

Fri, 07/08/2016 - 07:57
Here only i learned back-end process of htaccess file. Thank You Genius :)

madhushalini

Sat, 05/13/2017 - 12:52

Hello,

RewriteCond %{HTTPS} on

RewriteRule ^/?$ http://%{SERVER_NAME}/ [R=301]

RewriteRule ^inner/directory/?$ http://%{SERVER_NAME}/inner/directory/ [R=301,L]

after using this above code i faced a problem like directory index listing enable and trying to make it disable is not working using htaccess file or other source. 

just i need to redirect HTTPS to HTTP . please provide me a solution for this and also let me how to disable the index listing. 

i used many possible way to redirect or disable index listing is not working..

Raj0130

Wed, 05/30/2018 - 06:46

I want to say my website ssl remove & http (S) only how to remove any suggest 

prashant

Thu, 07/18/2019 - 07:07

I hope this will be helpful for someone

RewriteEngine On

RewriteBase /

# Turn SSL on for /user/login

RewriteCond %{HTTPS} on

RewriteCond %{REQUEST_URI} ^/(yourfilename\.php)$ [NC]

RewriteRule ^(.*)$ http://%{HTTP_HOST}/$1 [R=301,L]

# Turn SSL off everything but /user/login

RewriteCond %{HTTPS} off

RewriteCond %{REQUEST_URI} !^/(yourfilename\.php)$ [NC]

RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

 

Thiru

Tue, 03/03/2020 - 06:23

How can you ensure that sensitive pages, like login or checkout pages, remain secure even if the general site is redirected to HTTP?

Regard desain

Desain

Sun, 09/07/2025 - 12:35

I don't adivse you to ever redirect to http. In fact, it's probably best to redirect from http to https!

This post is quite old, from a time on the internet when ssl certs were quite difficult to install and maintain, or were quite expensive.

Phil Norton

philipnorton42

Mon, 09/08/2025 - 12:07

Add new comment

The content of this field is kept private and will not be shown publicly.

Related Content

Drupal 9: The Correct Way To Redirect A Page

22nd May 2022

I was recently working with a Drupal 9 site and found some strange behaviour when saving certain types of content. The page would appear to save, but much of the content appeared to be missing. It had even failed to generate the paths for the page based on the path auto rules.

Read more

Turning Off Apache Basic Authentication For A Single Directory

11th September 2013

When setting up staging sites or similar I often add a simple Apache authentication check in order to stop everyone from viewing the site. This is also useful in stopping search engine spiders from accessing a site with testing content on it, which generally causes trouble. It isn't amazingly secure, but it keeps almost everyone out.

Read more

IE8 Downloading docx Files As zip On Apache

23rd January 2012

I recently built a Drupal site on an Apache server setup and everything seemed fine until someone running IE8 tried to download a .docx file. For some reason IE8 insisted that this file was a .zip file and would open it as such, causing a bit of confusion as to what the problem was.

Read more

Localhost Apache 2 Server Warning On Ubuntu 11

19th September 2011

I was recently setting up a localhost environment with Ubuntu 11 and after adding all of my needed VirtualVost directives I found that I could start/restart the server but that I found the following error when trying to start the server.

Read more