I want to redirect my subdomain to https. My .htaccess file contains the following:  RewriteEngine On RewriteCond %{HTTPS} !on RewriteRule (.*) https: //%{HTTP_HOST}%{REQUEST_URI}   It's redirecting to https but my chrome browser giving an error      This webpage has a redirect loop The webpage at https:    //sub.domain.com/ has resulted in too many redirects. Clearing your   cookies for this site or allowing third-party cookies may fix the   problem. If not, it is possibly a server configuration issue and not a   problem with your computer. Learn more about this problem. Error code:   ERR_TOO_MANY_REDIRECTS   please help me
487
This is a  about Apache's mod_rewrite.   Changing a request URL or redirecting users to a different URL than the one they originally requested is done using mod_rewrite. This includes such things as:   Changing HTTP to HTTPS (or the other way around) Changing a request to a page which no longer exist to a new replacement. Modifying a URL format (such as ?id=3433 to /id/3433 ) Presenting a different page based on the browser, based on the referrer, based on anything possible under the moon and sun. Anything you want to mess around with URL   Everything You Ever Wanted to Know about Mod_Rewrite Rules but Were Afraid to Ask!  How can I become an expert at writing mod_rewrite rules?   What is the fundamental format and structure of mod_rewrite rules? What form/flavor of regular expressions do I need to have a solid grasp of? What are the most common mistakes/pitfalls when writing rewrite rules? What is a good method for testing and verifying mod_rewrite rules? Are there SEO or performance implications of mod_rewrite rules I should be aware of? Are there common situations where mod_rewrite might seem like the right tool for the job but isn't? What are some common examples?   A place to test your rules  The  web site is a great place to play around with your rules and test them. It even shows the debug output so you can see what matched and what did not.
105298
When I´m in a secure part of a web-site I´m developing (entering a specific page or folder using https), the relative links to the normal pages are automatically converted to https as well. Is there a way to tell an &lt;a&gt; tag to always use the http protocol instead of the https protocol (or the other way around)? I know it´s easy using the complete link ( or ), but I would like it to work with relative links (index.html, ../index.html, etc.).
91575
I'm trying to get apache to redirect from http to https, however I want them both on the same port (20100, but I doubt that will matter). Basically what's going on  except I'm not doing this for webmin. Currently I have it configured to serve HTTPS, and when I access with HTTP I get:  Your browser sent a request that this server could not understand. Reason: You're speaking plain HTTP to an SSL-enabled server port. Instead use the HTTPS scheme to access this URL, please.   There seem to be a lot of somewhat similar questions, however I am unable to find one that actually answers my question.
64077
Following the recent Google announcements about  we have a number of clients asking about this. Is it safe to just 301 redirect all pages to their SSL equivalent, for example in a common PHP include file:  if($_SERVER['HTTPS']!="on"){     $redirect= "https://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];     header("Location:$redirect",true,301);     exit(); }   Obviously I'm aware this is also possible within a .htaccess file but that cannot be modified in our case.  Obviously all internal links would be switched to https:// links but obviously we need to sort out incoming links from Google and elsewhere.   Is this a sound approach? Are there any other gotchas to be aware of?
5358
About a week ago I made the switch to https on one of my sites. I'm positive I did everything right. Properly setup 301 redirects from http to https versions. Added and verified https version in Webmaster Tools. Updated all internal links. Submitted new sitemap.  Despite that, many of my pages (about 40%) lost their rankings almost immediately. Those that dropped went from page 1 to nowhere. I can still see them indexed if I search for the URL, but otherwise it's like Google doesn't know they exist.  SSL Labs shows an "A" when I run their test and I have no manual actions showing in Webmaster Tools.  This is really frustrating. I don't actually need SSL, but Google finally scared me into it. Now I'm regretting the switch and contemplating going back to non-secured URLs.  Anything else I could have missed?
11157
I'm moving from HTTP to HTTPS for my entire site. The site is currently added to Google Search Console (formerly Google Webmaster Tools) as www.example.com and all the pages are indexed without using SSL.  How do I go about moving to the new HTTPS URLs on Google Search Console?   Do I just submit an updated sitemap which has the HTTPS URLs or do I add a new site as https://www.example.com and submit the sitemap with HTTPS URLs? All current URLs are set to redirect to their HTTPS counterparts. Do I add multiple properties to Google Search Console?
121029
I'm using nginx with SSL, and I want to always redirect to www, regardless of whether the request is http or https. I just want to redirect to the respective protocol www version.  I have the port 80 server block working fine. Beneath my first server block I have...  server {     listen      80;     server_name example.com;     return 301  $scheme://www.example.com$request_uri; }   and this works fine. But for my port 443 server block for https, I have all kinds of information inside regarding ssl on and different ciphers to use.  I really don't want to mess up anything up related to security by doing something stupid.. so my question is on this block for port 443...  server {     listen      443;     server_name example.com;     return 301  $scheme://www.example.com$request_uri; }   do I need anything else? do I need ssl on or any other security related things? If they visit non-www does that mean it transfers the request insecurely or something (even for a split second while its redirecting?)  Just want to make sure what I have is solid and secure. It seems to work but I want to double check.  Thanks!
67349
I am trying to redirect users to a custom URL after they logged in, but my code doesn't work.  How do I redirect users after they logged in?
104177
Stack Exchange  that were used for .  However, there doesn't seem to be a uniform way in which SE handles their domains. Examples below.    Some of these domains currently redirect to their respective contest sites, though almost all the redirects are broken. The SSL errors are probably broken by SE's .    [SSL error] for   [redirect broken] for   [redirect broken] for   [SSL error] for   [redirect broken] for   [redirect broken] for   [redirect broken] for   [redirect broken] for   [redirect broken] for    Some of these domains were not renewed and no longer owned by SE (!!!)    for   for    Some domains don't seem to have been used before but are randomly redirected to the contest main page (which is perfectly alright but I'd just want to point out).         Of course, this list isn't exhaustive and I've missed out some.  So,   How does SE manage these special one-time-use event domains?  Can the broken redirects be pointed to the correct sites? How does SE decide which of these domains to renew? Did SE purposefully let the expired domains lapse or ...?   * Also related: .
2810
Google Chrome is probably one of the stricter browsers out there in terms of highlighting SSL errors.  Most browsers will point out when you are viewing an HTTPS page which loads insecure images/Javascript, I understand how this is a security issue - an attacker could have modified the non-SSL content in a way which gives them access to the secure content, injected some javascript for example.  However once you have viewed an HTTPS page with mixed content, Google Chrome will continue showing you the mixed content warning (a red line through the 'https://') for as long as you stay browsing the same domain, even for subsequent pages which only include other HTTPS resources. Only once you navigate to another domain, or open a fresh tab does it tell you you're secure again.  What is the danger it's protecting you from here? How could mixed content on a previous page actually affect the security of subsequent secured pages? I understand that mixed content should be flagged up, but there must be a specific reason that Google is persisting this warning, other than "Well you still need to know about it"
123352
I used to operate a website with an SSL certificate, but have stopped using the SSL certificate. The problem is that most of the external links to the website use the https:// prefix.  I have tried the https:// to http:// redirect in the .htaccess file:  RewriteEngine On  RewriteCond %{HTTPS} on RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI}   But it seems, as has been pointed out elsewhere, that the server is trying to retrieve the certificate before activating the redirect. Hence, an error is shown before the redirect is ever accomplished. The error is either a warning that the certificate is expired, or if I delete the certificate signing request, then an error that SSL received a record that exceeded the maximum permissible length.  Is there any way to allow the incoming links to be redirected properly?
101625
Google Chrome 41.0.2272.118, Ubuntu 14.04    This is the second time I have had this error in the last week or so. Is this a bug on my part, or is there something up with the SE security certificate?  I've changed to bug because of :     No, it's something Stack Exchange would have to fix. Chrome is following the rules. But considering the whole meta.*.stackexchange.com dilemma is what's been holding up a lot of the HTTPS support, I doubt they're going to come up with any kind of fix for the www.*.stackexchange.com redirect problem. –  animuson♦
104292
Is there a way to redirect all my subdomains without specify the domain, I mean for example:  when I write www it should resolve to www.mydomain.com or if I write ftp it should redirect to ftp.mydomain.com  I know I could write wildcards in the hosts file but I'm not sure how to write something where the wildcard take the subdomain and concatenate it with mydomain.com
201
We're using setup with an nginx on one machine and (currently) one application server on apache in the back.  For multiple domains we got ssl certs, but only for the domain itself. So without subdomain www. Everything works as expected, we do not use the  anywhere. But we have customers who are typing this in by hand, resulting in a warning in the browser on the clientside. ..and a new seo guy insisting on working www subdomain WITH ssl.  What am i looking for: A creative solution which does not require new certificates for 20+ domains.  I already thought about getting certificates from let's encrypt for our www subdomain, then 301 to domain.tld.. but it's still in beta.  Any ideas ?
29186
What are the pros and cons of having http://www.example.com/ vs http://example.com/?  For example a problem I'm aware of is that if I use a domain without www I can't set a cookie for the current subdomain only (since there is no subdomain), and the cookies I set will be sent to all subdomains.
111579
With the release of Chrome Version 44.0.2403.89 m, I've noticed that our site is now completely broken. All of the HTTP URLs are being redirected to HTTPS URLs, which is a problem because our site does not support HTTPS.   Please note, this is not happening in any other browser, and was working on the previous Chrome release.  I've tried to replace all of our stylesheet calls with relative links, and that has worked, but the images that are loaded in automatically or through absolute paths as well as the navigation is still broken. Please see below image for the error page that is thrown when navigating, after accepting the security warning and proceeding.    Anyone have any advice as far as updating perhaps the .htaccess file goes, or something in functions?  Thanks.
108169
I have a local DNS server that resolves all URLs *.domain.tld to 127.0.0.1. Also, I have the production server with the same address *.domain.tld. They have the same names, because subdomains interact with each other, and I have hardcoded domain URLs. I can't change them in the production server.  The problem is to reach the production server from my developer computer without touching the DNS server and /etc/hosts.  I found some options for Chrome such as --dns-server, --host-rules, but none is working. I have Google Chrome 23.0.1271.64 and Chromium 22.0.1229.94 on Ubuntu 12.10 64-bit.