How to Force HTTPS in WordPress with .htaccess (No Plugins)

To force HTTPS in WordPress without a plugin, add these three lines to your .htaccess file, right before the WordPress block:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

That's the core of it. The rest of this article explains why it works, how to handle different scenarios (www vs. non-www, subdomains, Cloudflare), and what pitfalls to avoid.

Why Edit .htaccess Instead of Installing a Plugin?

HTTPS redirect plugins are convenient, but they add a PHP layer that runs on every request. An .htaccess rule is processed by Apache directly — before PHP even starts — which means:

• Faster response times.
• One fewer dependency to keep updated.
• No risk of the redirect breaking because a plugin was deactivated or conflicted with another.

If your hosting runs Apache with mod_rewrite (the vast majority of cPanel plans), this is the cleanest solution available.

How to Access and Edit .htaccess

The .htaccess file lives in the root of your WordPress installation — the same folder as wp-config.php and the wp-content directory. You have three options:

Option 1: cPanel File Manager

1. Log in to cPanel and open the File Manager.
2. Navigate to public_html (or the subfolder where WordPress is installed).
3. Enable "Show hidden files" if .htaccess doesn't appear in the list.
4. Right-click .htaccess → Edit.

Option 2: FTP / SFTP Client

Using FileZilla or another client, connect to your server, locate .htaccess in the site root, download it for local editing, then re-upload the saved file.

Option 3: SSH

If you have SSH access, simply run nano public_html/.htaccess and edit the file directly on the server.

Redirect Rules: Every Scenario

The WordPress block in .htaccess normally looks like this:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

You must place your HTTPS rule before the # BEGIN WordPress comment. WordPress regenerates the marked block automatically and would overwrite any rules you place inside it.

Basic Redirect (HTTP → HTTPS, Any Domain)

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Force www (With HTTPS)

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Force Non-www (With HTTPS)

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

Behind Cloudflare or a Reverse Proxy

Cloudflare terminates SSL at its edge and forwards requests to your origin as plain HTTP. In that case %{HTTPS} is always off even when visitors use HTTPS. Use the header Cloudflare appends instead:

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Important: don't use X-Forwarded-Proto if your traffic doesn't pass through a trusted proxy — any visitor could forge that header.

Update WordPress After Adding the Redirect

Once the rule is in place, make sure WordPress itself knows the site runs on HTTPS:

1. Go to Settings → General in the admin dashboard.
2. Update both the WordPress Address and the Site Address to start with https://.
3. Save. WordPress will log you out; sign back in over HTTPS.

If you have mixed content warnings (images or scripts still loading over HTTP), temporarily use the Really Simple SSL plugin or run a search-and-replace SQL query on the database to update stored URLs.

For high-performance hosting where security and speed go hand in hand, check out the plans at elenlace.com.

Common Mistakes and How to Avoid Them

For a full guide on SSL certificates — installation, renewal, and certificate types — visit our SSL security and HTTPS resource section.

Key Takeaways

• Add the HTTPS redirect rule before the # BEGIN WordPress block so it isn't overwritten.
• Use %{HTTPS} off as the condition to prevent infinite redirect loops.
• On Cloudflare, switch SSL mode to Full (strict) and use X-Forwarded-Proto as the condition.
• Update both site URLs in Settings → General so WordPress serves everything over HTTPS.
• Fix mixed-content warnings after the migration to keep the browser padlock green.

Does your site already have an SSL certificate but traffic still isn't redirecting to HTTPS? Apply the rules in this guide — and if you'd rather have an expert handle it, the team at elenlace.com can set it up for you.

FAQ

Do I need the SSL certificate installed before adding the redirect rule?

Yes, absolutely. If you add the redirect without a valid certificate, visitors will see a browser security error and won't be able to reach your site. Install the SSL first (Let's Encrypt in cPanel is free) and then add the rule.

Does a 301 redirect hurt SEO?

Quite the opposite: Google recommends HTTPS, and a 301 redirect passes almost all of the link equity from your HTTP URLs to their HTTPS counterparts. You may see a small ranking fluctuation short-term; over the medium term, the HTTPS site ranks better.

Can I use these rules on WordPress Multisite?

Yes, carefully. On Multisite with subdomain mapping, the basic rule works the same way. If you're using subdirectory mode, make sure RewriteBase is correctly set for each site. Always test on a staging environment first.

What's the difference between R=301 and R=302?

A 301 is a permanent redirect: it tells search engines the URL has changed for good and they should update their index. A 302 is temporary: search engines don't transfer SEO value with it. Always use 301 when permanently migrating from HTTP to HTTPS.

Compare providers

Other providers and guides worth comparing:

• HubSpot
• IONOS
• GoDaddy