Force redirect visitors to https

Do you have an SSL certificate on your website? Then you also want all visitors to end up on the secure https version, and no longer on http. Below you'll read how to set that up, and what to do if your site stops working afterwards or after a move.

In DirectAdmin

1. Log in to DirectAdmin: in My WebOké, go to My Products and click DirectAdmin next to your hosting package.
2. Under Account Manager, click Domain Setup and click your domain name.
3. Check whether Secure SSL Connection is turned on. Only then will you see the options below.
4. Under SSL, turn on the switch Force SSL with https Redirect.
5. Click Save to save.

There's also an option there called Use HTTP Strict Transport Security (HSTS). On most of our servers, the web server already sends HSTS by default for every website with https, with a max-age of one year. In that case, you don't need the switch. You can check whether your site already sends HSTS in the test on internet.nl. Only turn on the switch if your site doesn't yet send HSTS and your certificate works for all names: browsers remember HSTS for a long time, and if the certificate doesn't work later, visitors will no longer be able to open your site. More explanation can be found in HSTS and security headers for your website.

On the same page, under Force Redirect, you choose whether visitors always go to the address with www or without www.

Or in your website

Many programs can do it themselves. In WordPress, under Settings › General, set the WordPress address and the site address to https://. Only use one redirect: not at the same time in DirectAdmin and in a plugin or in .htaccess. Otherwise your website may keep redirecting in a loop.

Does your site stop working after https or a move?

Go through these steps in order:

1. First try a private window or a different browser. Your browser may remember an old page or an old redirect. If it does work there, clear your browser's cache.
2. Message 'too many redirects' or 'page isn't redirecting properly'? Then two settings are sending each other back and forth. For example Force SSL and a plugin, a custom rule in .htaccess, or a different choice for with or without www in DirectAdmin than in WordPress. Turn off one of the two. If you use Cloudflare's proxy with the SSL mode Flexible, choose Full (strict) there instead.
3. Certificate error or a certificate in the server's name? After a move or a DNS change, the certificate is often not yet issued. That can only happen once the domain points to our server, and sometimes takes a few hours. Turn off the https redirect in the meantime and request the certificate as described in Activating an SSL certificate.
4. Certificate error without a button to continue anyway? Then your browser has remembered HSTS for your site. You can't skip that message: first make sure you have a working certificate. Visitors who already opened your site via https before will only be able to get in again once the certificate works.
5. Do you see a blank or different page under https, with text saying you need to upload an index.html to private_html? Then private_html is still a separate folder for your domain. Read Message: To change this page, upload a new index.html to your private folder.

Is your whole website unreachable, even without https? Then follow the steps in My website is unreachable.

Can't figure it out? Create a ticket with your domain name and the message you see.

Also see in the DirectAdmin guide: No padlock or 'not secure': fixing mixed content, Let's Encrypt not working: causes and solutions and Domain settings: SSL, PHP, www and private_html.

Detailed explanation with screenshots: Always sending visitors to https in the DirectAdmin guide.