HTTP to HTTPS Redirect Automatically with .htaccess & Nginx (Complete Guide)

Transitioning your website from unencrypted HTTP to secure HTTPS is one of the foundational requirements of modern web development and search engine optimization. Google confirmed HTTPS as an official ranking signal, and modern web browsers like Chrome and Safari display stark “Not Secure” warnings to visitors accessing unencrypted HTTP URLs. Without an automatic, server-level 301 redirect in place, search engines crawl duplicate versions of your website (both HTTP and HTTPS), splitting PageRank and causing crawl budget fragmentation.

In this comprehensive technical walkthrough, you will learn how to configure bulletproof 301 redirects from HTTP to HTTPS across Apache (.htaccess), Nginx, GoDaddy cPanel, Cloudflare Edge, and AWS CloudFront, while avoiding infinite redirect loops and preserving full organic search authority.

Why Server-Level 301 HTTPS Redirection is Critical for SEO

Many webmasters make the mistake of relying on CMS plugins or JavaScript redirects to force HTTPS. This creates severe performance lag and indexation issues:

• Search Engine Protocol Consolidation: Google indexes http://example.com and https://example.com as two completely independent entities. An automated HTTP 301 (Moved Permanently) response informs Googlebot to transfer 100% of link equity (PageRank) to the HTTPS canonical URL.
• Browser Trust & Conversion Rates: Over 82% of online shoppers immediately abandon a purchase or registration if the browser URL bar signals an unencrypted connection.
• HTTP/2 & HTTP/3 Protocol Support: Modern speed protocols like HTTP/2 and HTTP/3 (QUIC) mandate TLS encryption. By enforcing HTTPS, you unlock multiplexing, header compression, and sub-second Time to First Byte (TTFB).

1. Apache & .htaccess Redirect Rules (Standard & Reverse Proxy)

If your website runs on Apache (e.g., cPanel shared hosting, VPS with LAMP stack, or standard WordPress installations), you can enforce HTTPS using your root .htaccess file. Place these directives at the very top of your .htaccess before any WordPress or CMS rewrite rules.

Standard Apache Rewrite Rule

Use this configuration when your Apache server handles SSL certificates directly (e.g., Let's Encrypt or Sectigo installed directly in cPanel):

# Enforce HTTPS 301 Redirect
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Reverse Proxy / Load Balancer Configuration (Cloudflare, AWS ALB, Nginx Proxy)

If your website sits behind a reverse proxy or Content Delivery Network, the connection between the user and the CDN is encrypted (HTTPS), but the CDN may connect to your origin server over HTTP. In this architecture, checking %{HTTPS} off triggers an infinite redirect loop. Instead, inspect the X-Forwarded-Proto request header:

# Enforce HTTPS behind Cloudflare or AWS Reverse Proxy
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

2. Nginx Server Block Redirection Configuration

For high-performance websites running Nginx, configure your HTTP listener block (port 80) to return an immediate 301 redirect to the HTTPS server block (port 443). Open your domain's virtual host configuration file (e.g., /etc/nginx/sites-available/example.com) and add:

# Port 80 - Redirect all HTTP requests to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    # 301 Permanent Redirect preserving URI and arguments
    return 301 https://$host$request_uri;
}

# Port 443 - SSL Virtual Host
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    root /var/www/html;
    index index.html index.php;
    # Remaining application logic...
}

After editing, test the syntax with sudo nginx -t and reload the service using sudo systemctl reload nginx.

3. GoDaddy cPanel & Shared Hosting HTTPS Forwarding Setup

If you host your domain and website on GoDaddy cPanel shared hosting, you can enforce HTTPS without manually editing raw configuration files:

1. Install the SSL Certificate: In GoDaddy cPanel, go to Security > SSL/TLS Status. Ensure your domain has an active Let's Encrypt or GoDaddy AutoSSL certificate applied to both example.com and www.example.com.
2. Enable Force HTTPS in cPanel Domains:
   • Navigate to Domains > Domains in your cPanel dashboard.
   • Locate your primary domain name.
   • Toggle the Force HTTPS Redirect switch to On. cPanel automatically injects the optimized rewrite rules into your server configuration.
3. Update WordPress Site URLs: If you run WordPress, log in to your WordPress admin panel, go to Settings > General, and ensure both WordPress Address (URL) and Site Address (URL) begin with https:// rather than http://.

4. Cloudflare Edge Redirection (Always Use HTTPS & Page Rules)

If your DNS routes through Cloudflare, enabling edge-level HTTPS redirection is the fastest method because redirects execute at Cloudflare's nearest edge server before incoming requests ever touch your origin server:

1. Log in to your Cloudflare Dashboard and select your domain.
2. Navigate to SSL/TLS > Edge Certificates.
3. Ensure your SSL encryption mode is set to Full (Strict). Never use "Flexible" as it causes redirect loops with origin .htaccess rules.
4. Toggle Always Use HTTPS to On. Cloudflare will automatically reply with a 301 redirect to all incoming port 80 HTTP requests.
5. Enable Automatic HTTPS Rewrites to automatically rewrite third-party insecure asset URLs (images, scripts, styles) from HTTP to HTTPS, eliminating mixed content warnings.

5. Common Redirection Pitfalls & How to Prevent Infinite Loops

6. Verification Checklist: cURL, Mixed Content & Search Console

Once you deploy your redirection rules, verify that search engine crawlers receive clean HTTP 301 responses. Run this diagnostic command in terminal or PowerShell:

curl -IL http://yourdomain.com

Confirm that the first response header returns HTTP/1.1 301 Moved Permanently with the Location: https://yourdomain.com/ header, followed immediately by HTTP/2 200 OK. Finally, update your XML sitemaps to reference only secure HTTPS URLs and submit your verified HTTPS domain property inside Google Search Console to guarantee seamless SEO authority transfer.