Force WWW and HTTPS with .htaccess

MasterOne

I have opted for a fixed IP and SSL certificate for our forum, and now I would like to have all access secured by SSL. There seem to be more ways to do it using .htaccess and the Apache rewrite engine. Since the SSL certificate is issued for www.domain.com the rewrite magic should take care of the www as well. The most reasonable that came up was:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://www.<DOMAIN>.com/$1 [R=301,L]
RewriteCond %{HTTP_HOST} !^www.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L]

but I also found rewrite rules using {REQUEST_URI} as well.

How would you solve that issue?

And is there any downside to force HTTPS for all access?

vrijvlinder

SEO , I believe that encrypted pages can't get crawled

http://www.seroundtable.com/ssl-website-rank-google-16609.html

x00

@vrijvlinder said:
SEO , I believe that encrypted pages can't get crawled

http://www.seroundtable.com/ssl-website-rank-google-16609.html

That is not what the article says read it again.

vrijvlinder

Yes ,That's why I posted the article to get more insight.

advice if you do go the SSL route:
don't forget the http->https redirect & other canonicalization things
look into HSTS
list the https site separately in webmaster tools (it's a different site)
make sure the infrastructure can handle the higher load (SSL, caching, etc)
check out the differences wrt. caching

MasterOne

The 301 rewrite rules as shown above should take care of the mentioned, as also stated in the last comment on that referred web page.

I don't understand why the HTTPS site should be listed separately in webmaster tools, because if you go HTTPS only then the HTTPS site should be listed only (if the crawler tries to access the site by HTTP it gets 301 redirected to HTTPS).

vrijvlinder

See these

http://www.symantec.com/connect/blogs/understanding-always-ssl-and-seo

http://webmasters.stackexchange.com/questions/47636/how-do-i-transition-to-ssl-without-affecting-pagerank