Redirect http to https, with and without www, the right way

Do all versions of my address end up on the same page?Check it for free with our Redirect Checker

Your website can be reached under four versions: http://example.com, http://www.example.com, https://example.com and https://www.example.com. Ideally all four redirect in a single step to the same address with https://. Our redirect checker shows whether that is the case for you.

Why this matters

• Security: if one version stays on http, data is transferred unencrypted and browsers show “Not secure”.
• Google: if two versions with the same content are reachable, Google treats them as duplicate pages. That can weaken your ranking.
• A consistent presence: links, bookmarks and statistics all gather on a single address.

With or without www?

It is a matter of taste. Without www is shorter and more modern, with www is traditional. Technically it makes hardly any difference. What matters is that you choose one and permanently redirect the other.

The prerequisites

1. DNS records for both versions. Both example.com and www.example.com must point to your server. The DNS lookup shows whether that is the case.
2. An SSL certificate for both versions. Otherwise visitors see a certificate warning on one of them before the redirect even kicks in. Check this with the SSL checker under “Covered domains”.

Setup on Apache (.htaccess)

On most hosting plans, you add these lines at the very top of the .htaccess file in your root directory. This example redirects everything to https://example.com without www:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [L,R=301]

If you want the www version, replace the last two conditions:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [L,R=301]

Replace example.com with your domain and make a backup copy of the file first.

Setup on Nginx

Two additional server blocks handle the redirect, while the main block serves the site:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl;
    server_name www.example.com;
    # ssl_certificate … as in the main block
    return 301 https://example.com$request_uri;
}

WordPress

Under “Settings → General”, enter the desired address with https:// in both address fields. However, this does not reliably redirect http to https. For that you also need the .htaccess rule above or the corresponding setting at your host.

Watch out: if you set the address in WordPress incorrectly, you may lock yourself out of the dashboard. Note down the old values first.

Hosts with their own control panel

Many hosts and platforms such as Plesk, cPanel or Coolify offer a switch like “Force HTTPS” or “Redirect to www”. That is usually the simplest solution. Afterwards, use the redirect checker to confirm that all four versions end up in the right place.

301 or 302?

Always use 301 (or 308) for permanent redirects. That tells browsers and search engines that the new address is the right one. A 302 redirect means “temporary”, and Google may then keep the old address in its index.

The final step: HSTS

Once everything works, the HSTS header lets you tell browsers to only ever access your site over HTTPS in future, even if someone types http://. How to do that is explained in Security headers explained.