{"id":8710,"date":"2014-11-09T19:33:42","date_gmt":"2014-11-09T19:33:42","guid":{"rendered":"https:\/\/wp.okra.host\/article\/forcing-http-redirect-to-ssl\/"},"modified":"2021-03-07T21:27:03","modified_gmt":"2021-03-07T20:27:03","slug":"forcing-http-redirect-to-ssl","status":"publish","type":"ht_kb","link":"https:\/\/kb.okra.host\/de\/article\/forcing-http-redirect-to-ssl\/","title":{"rendered":"HTTP-Umleitung auf SSL erzwingen"},"content":{"rendered":"

Overview<\/h2>\n

Converting HTTP to HTTPS resources can be accomplished in several ways. It goes without saying that you should setup and test your SSL certificate before performing any of the following methods.<\/p>\n

Strict Transport Security<\/h3>\n

Modern browsers support a security standard called \u201cHTTP Strict Transport Security<\/a>\u201c, or HSTS for short. HSTS sends a header with the URI response to indicate that future requests should use HTTPS.<\/p>\n

To utilize HSTS, add the following line to a .htaccess<\/a> in the document root<\/a> of the domain\/subdomain:<\/p>\n

Header always set Strict-Transport-Security \"max-age=63072000;\"\r\n<\/code><\/pre>\n
The above example restricts mandatory SSL for the domain only. To extend this policy to subdomains as well, such as forum.example.com and blog.example.com, add \u201cincludeSubdomains\u201d:<\/p>\n
Header always set Strict-Transport-Security \"max-age=63072000; includeSubdomains;\"<\/code><\/pre>\n
Downsides:<\/strong>\u00a0first request if sent over HTTP will not be encrypted, requires browser compliance<\/span><\/span><\/p>\n
Upsides:\u00a0<\/strong>easy to implement, SSL can propagate to subdomains, directive is cached in browser<\/span><\/span><\/p>\n
mod_rewrite Rewrite<\/h3>\n
By utilizing mod_rewrite<\/a>, add the following to a .htaccess<\/a> file in the document root<\/a> of the domain\/subdomain that you would like to redirect:<\/p>\n
RewriteEngine On\r\nRewriteBase \/\r\nRewriteCond %{HTTPS} !^on$\r\nRewriteRule ^(.*)$ https:\/\/%{HTTP_HOST}\/$1 [R,L]<\/pre>\n
Downsides:<\/strong>\u00a0can be complex, does not extend to subdomains without a common parent directory, can create a redirect loop<\/span><\/span><\/p>\n
Upsides:\u00a0<\/strong>extremely flexible implementation<\/span><\/span><\/p>\n
WordPress<\/h3>\n
WordPress creates absolute URIs. If WordPress is installed over http:\/\/, then all URIs will reflect http:\/\/. To convert generated URIs from http:\/\/ to https:\/\/, login to the WordPress administrative panel<\/a>, go to Settings<\/strong> > General<\/strong>. Change both the WordPress Address and Site Address fields from http:\/\/\u2026 to https:\/\/\u2026 If not all links, such as old posts, have changed correctly, use a third-party plugin such as Really Simple SSL<\/a>\u00a0to update all post data.<\/p>\n
\n
\"\"<\/a><\/p>\n
WordPress SSL tunables<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
Overview Converting HTTP to HTTPS resources can be accomplished in several ways. It goes without saying that you should setup and test your SSL certificate before performing any of the following methods. Strict Transport Security Modern browsers support a security standard called \u201cHTTP Strict Transport Security\u201c, or HSTS for short….<\/p>","protected":false},"author":1,"comment_status":"open","ping_status":"closed","template":"","format":"standard","meta":{"footnotes":""},"ht-kb-category":[67],"ht-kb-tag":[],"class_list":["post-8710","ht_kb","type-ht_kb","status-publish","format-standard","hentry","ht_kb_category-ssl"],"_links":{"self":[{"href":"https:\/\/kb.okra.host\/de\/wp-json\/wp\/v2\/ht-kb\/8710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kb.okra.host\/de\/wp-json\/wp\/v2\/ht-kb"}],"about":[{"href":"https:\/\/kb.okra.host\/de\/wp-json\/wp\/v2\/types\/ht_kb"}],"author":[{"embeddable":true,"href":"https:\/\/kb.okra.host\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kb.okra.host\/de\/wp-json\/wp\/v2\/comments?post=8710"}],"version-history":[{"count":2,"href":"https:\/\/kb.okra.host\/de\/wp-json\/wp\/v2\/ht-kb\/8710\/revisions"}],"predecessor-version":[{"id":8825,"href":"https:\/\/kb.okra.host\/de\/wp-json\/wp\/v2\/ht-kb\/8710\/revisions\/8825"}],"wp:attachment":[{"href":"https:\/\/kb.okra.host\/de\/wp-json\/wp\/v2\/media?parent=8710"}],"wp:term":[{"taxonomy":"ht_kb_category","embeddable":true,"href":"https:\/\/kb.okra.host\/de\/wp-json\/wp\/v2\/ht-kb-category?post=8710"},{"taxonomy":"ht_kb_tag","embeddable":true,"href":"https:\/\/kb.okra.host\/de\/wp-json\/wp\/v2\/ht-kb-tag?post=8710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}