Knowledge Base

Once you’ve installed an SSL certificate, your site is ready for secure browsing over HTTPS. But unless you force it, visitors might still land on the insecure HTTP version. Forcing HTTPS ensures all traffic is encrypted — improving security and SEO.

Why Forcing HTTPS Matters

• Ensures all users are protected with SSL encryption
• Prevents duplicate content (SEO boost!)
• Displays the padlock icon in browsers
• Helps maintain trust and privacy

Method 1: Force HTTPS via .htaccess (Recommended for Most)

If you’re using Apache (common on most cPanel hosting environments like Nextel Systems):

Steps:

1. Open cPanel
   Go to yourdomain.com/cpanel and log in.
2. Navigate to File Manager
   • Open File Manager under the Files section.
   • Go to the public_html directory.
3. Edit the .htaccess file
   • If it doesn’t exist, create a new one.
   • Add the following code at the top:

   RewriteEngine On
   RewriteCond %{HTTPS} off
   RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
   

4. Save Changes and refresh your site using https://yourdomain.com

Method 2: Force HTTPS in cPanel (AutoSSL/Redirect Option)

Some cPanel environments include a Force HTTPS Redirect toggle:

1. Go to Domains in cPanel.
2. Find your domain in the list.
3. Toggle “Force HTTPS Redirect” to ON.

This option automatically creates a redirect without editing .htaccess.

Method 3: WordPress Users – Force HTTPS in WP Settings

1. Log into your WordPress dashboard.
2. Go to Settings > General.
3. Update both the WordPress Address (URL) and Site Address (URL) to use https://.
4. Save changes.

You can also use the Really Simple SSL plugin to automatically detect and enforce HTTPS across the site.

Test the Redirect

Visit http://yourdomain.com — it should automatically redirect to https://yourdomain.com.

Use https://www.whynopadlock.com to test for insecure content.