How to enforce HTTPS (SSL) on all pages

Last Updated: Sep 01, 2017 03:08PM EDT


As you may have noticed, the Internet is trending towards "All HTTPS; all the time"! With more and more emphasis on security, search engines will soon be factoring a website's practices in this area, into their Page Rankings, as described in the following article:​

Many ProductCart merchants are asking the question...

What's the best way to force HTTPS ?

Well for starters, you'll need to make sure that you have a Dedicated SSL Certificate installed on your site. SSL (Secure Socket Layer) technology encrypts data exchanged between a server and a browser. When SSL is used, information is exchanged using the HTTPS protocol instead of the HTTP protocol, where data travels unencrypted. The address of a page delivered using the HTTPS protocol will typically become:

Secure Socket Layer (SSL) has largely been replaced by Transport Layer Security (TLS) around the internet. Some technical articles will make a distinction between the two related and very similar systems. For the purposes of discussing general security the terms are often used interchangeably. Because SSL is the long standing familiar term to discus the topic we will use it in this article. If your web host suggests a TLS certificate the distinction won't mater in relation to the information in this article.

SSL Certificates are issued to a specific sub domain (subdomain), so if you generally reference your site with the 'www' sub domain, then make sure that your SSL Certificate is issued to that exact URL/Domain. The following domains are not the same:

While the 'Root' domain is the same, the sub domains are all different and could even be hosted on different servers. To prevent issues that can occur when a server switches between sub domains, we recommend that you first choose and enforce a single sub domain throughout your entire site (and related navigation links and menus).

Once you have done that and your hosting provider has installed a dedicated SSL Certificate on your server, there are different ways to force all pages to load under HTTPS. There might be a 'setting' for this in the Hosting Control Panel, but we have found that enforcing this through a 'web.config' or '.htaccess' file is efficient. These are small 'text' files that control the behavior of the site or directory in which they reside.

Your server environment will help you determine which one you use. The name of the file must be (exactly)




You can create these files in Notepad and then upload them to the root directory of your website using an FTP program.


Most Windows Server envrionments will use a web.config file. The following content in a web.config file will force HTTPS for ALL resources (using a 301 Permanent Redirect):
<?xml version="1.0" encoding="UTF-8"?>
                <clear />
                <rule name="Redirect to https" stopProcessing="true">
                    <match url=".*" />
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" appendQueryString="false" />


Not all web servers will be set up to use an .htaccess file. Your web hosting provider can help you determine if this option is the right option for you. If you host your own website you may be interested in learning more about the necessary set up to use a .htaccess file at For the .htaccess file you need fewer lines of code and smaller overall file.
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$$1 [R=301,L]

In this case, make sure to edit the URL/Domain to reflect your own, before saving and uploading the file to the Root Directory on the server.

Make sure to test your site using different Protocols and URLs to make sure it's functioning and properly redirecting visitors to the HTTPS page.


  • Support Forums
  • Video Tutorials
  • Support Request
  • Support Policy
seconds ago
a minute ago
minutes ago
an hour ago
hours ago
a day ago
days ago
Invalid characters found