How to force my website to use HTTPS

Before you start: check the certificate works

Open https://yourdomain.co.za (with the s) in a private browser window. You need a padlock and no warning. If you see "Not secure" or a certificate error, fix that first, or forcing HTTPS will lock every visitor out of the site. See Why does my website say "Not secure"?

Free certificates are issued automatically once your domain's DNS points to your Webway server. If you just moved or pointed the domain, allow a few hours.

Option 1: One-click in cPanel

1. Log in to cPanel and open Domains.
2. Find the domain and switch Force HTTPS Redirect on.

Done. Repeat for subdomains and addon domains.

DirectAdmin: open Account Manager → Domains, click the domain, tick Force SSL with https redirect and save.

Option 2: Add a rule to .htaccess (cPanel and DirectAdmin)

This works on both panels. cPanel's Apache and DirectAdmin's OpenLiteSpeed both read .htaccess rewrite rules.

1. Open File Manager and go to the folder your site serves from (public_html for the main domain).
2. If you can't see .htaccess, click Settings and tick Show hidden files.
3. Right-click .htaccess and choose Edit. If it doesn't exist, create it.
4. Add these lines at the top of the file, above anything else:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

5. Save.

To also force www (or remove it), use this instead, replacing the domain:

RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} !^www\.example\.co\.za$ [NC]
RewriteRule ^ https://www.example.co.za%{REQUEST_URI} [L,R=301]

Swap the www. version for the bare domain in both places if you prefer example.co.za without www.

On WordPress, place the rule above the # BEGIN WordPress block. WordPress rewrites its own block and would otherwise overwrite your rule.

Option 3: WordPress settings

Do this as well as Option 1 or 2, not instead.

1. In WordPress, go to Settings → General.
2. Change both WordPress Address (URL) and Site Address (URL) to start with https://.
3. Save. You'll be logged out; log in again at the https address.

Old pages and images may still link to http:// addresses, which shows a "not fully secure" padlock. Fix with a search-and-replace plugin (for example Better Search Replace), replacing http://example.co.za with https://example.co.za across the database. Take a backup first.

Test

1. Open http://yourdomain.co.za (no s) in a private window. It should land on https:// with a padlock.
2. Test a deep link too, such as http://yourdomain.co.za/contact.
3. Check an online redirect checker shows a single 301 to the https address, not a chain.

Problems