Forcing https://

[jacmaes]

Now that CloudFlare has free Universal SSL, I'd like to serve my site over https://

What is the recommended PW approach to do this? Is it just a matter of tweaking the .htaccess file to force https:// ? If so, how would I go about it?

With one little tweak -- adding an "s" to the force "www." rewrite rule -- I can successfully redirect from http://domain.com to https://www.domain.com:

  RewriteCond %{HTTP_HOST} !^www\. [NC]
  RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301] 

But how should I deal with the second scenario: redirecting from http://www.domain.com to http s://www.domain.com? Everything I've tried ends up in a redirect loop. 

 

[netcarver]

Posting on the run but something similar was asked recently. You may find some clues there.

[jacmaes]

Thanks netcarver. Forcing https in the template's URLs tab does not seem to work, at least on 2.5.4 dev.

[netcarver]

Yes, I posted that as an issue on github - feel free to add a +1 over there to see if Ryan will bump its priority.

[jacmaes]

Done, although I would rather do this in the .htaccess file if possible so that I can quickly turn SSL on or off, and not have to do it on each and every template. Thanks again anyway. 

[bernhard]

meanwhile there's already an option in the htaccess: https://github.com/ryancramerdesign/ProcessWire/blob/master/htaccess.txt#L133

[DaveP]

If you are using CloudFlare, all you need to do is change your CloudFlare config. You don't get true end-to-end https that way, just between the browser & CloudFlare - not between CloudFlare & your site.

My blog (see sig) does it that way (and you get SPDY as an added bonus).