Forcing HTTPS means every visitor who types your domain, or clicks an old http:// link, is automatically sent to the secure https:// version of your site. This removes browser warnings, keeps your SEO rankings intact, and makes sure no page loads without encryption. Before you start, your website needs a working SSL certificate already installed. If yours isn't set up yet, see the article on installing a free SSL certificate with AutoSSL, then come back to this guide.
If you turn on a forced HTTPS redirect before your SSL certificate is installed and active, visitors will see a security warning instead of your site. Confirm your certificate is installed first.
In cPanel
- Log in to your cPanel account.
- Under the Domains section, click Domains.
- Find your domain in the list. In the Force HTTPS Redirect column, click the toggle to switch it On.
- Wait a minute or two, then open your site in a private/incognito browser window using the http:// prefix to confirm it redirects to https:// automatically.
If your version of cPanel doesn't show a Force HTTPS Redirect toggle, use the manual method below instead.
In DirectAdmin
- Log in to your DirectAdmin account.
- Go to Domain Setup (sometimes listed under Account Manager).
- Select your domain, then look for a Force SSL or Secure SSL checkbox and enable it.
- Click Save and give it a minute to apply, then test your site with the http:// prefix in a private/incognito window.
Not every DirectAdmin setup shows this option. If you don't see it, use the manual method below.
Manual Method: Redirect with .htaccess
If your control panel doesn't offer a built-in toggle, you can force HTTPS by editing the .htaccess file in your website's root folder (usually public_html). Open it with the File Manager in cPanel or DirectAdmin, or connect over FTP, and add these three lines near the top of the file:
- RewriteEngine On
- RewriteCond %{HTTPS} off
- RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Save the file and reload your site over http:// to confirm it now redirects to https://.
Always keep a copy of your original .htaccess file before editing it. A mistyped rule can make your site temporarily unreachable, and having a backup means you can undo the change in seconds.
Checking Everything Still Works
After enabling a forced redirect, click through your site's main pages, contact forms, and any payment or login pages to confirm nothing throws a mixed-content warning. If you see a padlock warning or "not fully secure" message on some pages, those pages likely still load an image, script, or stylesheet over http:// instead of https://, and those internal links need to be updated to match.