How to force SSL?

Kirby 2 Solved ✅
1

I want to force SSL to my webisite.
Eg: http://example.com to https://www.example.com

2

There is an option you can add in your config.php, that will make Kirby redirect http requests to https.

c::set('ssl', true);
3

You should do that in your server config file or your .htaccess

see: https://github.com/texnixe/kirby-secrets/blob/master/docs/htaccess.md

4

FWIW, I had to use c::set('ssl', true);, and don’t mess with the .htaccess as it didn’t work on my hosting…

5

I use this in .htaccess

RewriteEngine on
RewriteCond %{HTTP_HOST} !^(.*).local$
RewriteCond %{HTTPS} =off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [QSA,L,R=301]
2 Likes
6

I think the order should be like this depending on your hosting:

  1. DNS redirect (if possible)
  2. server config redirect (if you have your own server)
  3. .htaccess (if the hosting allows to set this setting via .htaccess)
  4. PHP based redirect (as a last resort; Kirby config setting as proposed by @bvdputte)
1 Like
7

@texnixe What are the disadvantages of the PHP method?

8

The other options kick in earlier. The PHP routes are great for more complicated logic, especially when working with Kirby objects.

10

@neemmeek Are you on Kirby 2 or 3? This should actually work automatically.

On Kirby 2, you could also try and enforce http in your config.php:

c::set('ssl', true);

https://k2.getkirby.com/docs/cheatsheet/options/ssl

(Note that there is no such setting for Kirby 3)

12

What if you set the url as well:

c::set('url', 'https://yourdomain.test');
15

Ah, I first thought the stylesheets didn’t get loaded, but it’s an issue with your fonts. How do you load them? Could you provide a link to the site?

16

When looking at source, error in console:

Mixed Content: The page at ‘https://naammaak.nl/’ was loaded over HTTPS, but requested an insecure stylesheet ‘http://fonts.googleapis.com/css?family=Righteous&subset=latin,latin-ext’. This request has been blocked; the content must be served over HTTPS.

How do I change the http://fonts.goo… into https? I know how to edit a “normal” html index page but how does that work with Kirby?

17

Open an editor and edit the template/snippet (probably /site/snippets/header.php), change http:// to https:, save, upload.

18

It worked. Thank you. You made my day!

19

P.s. Please be informed that I deleted the previous replies because as a new member I’m only allowed to add 3 replies… Thanks again for helping me out.

1 Like
20

Would anyone know where to place those lines in the Kirby 3 .htaccess file?

<IfModule mod_rewrite.c>
RewriteEngine on

# --- Here ?
# RewriteCond %{HTTP_HOST} !^(.*).local$
# RewriteCond %{HTTPS} =off
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [QSA,L,R=301]

RewriteRule (^|/)\.(?!well-known\/) index.php [L]
RewriteRule ^content/(.*)\.(txt|md|mdown)$ index.php [L]
RewriteRule ^site/(.*) index.php [L]
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
RewriteRule ^kirby/(.*) index.php [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*) index.php [L]
</IfModule>

<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE application/json
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

Also, what does this line do:

RewriteCond %{HTTP_HOST} !^(.*).local$

Thanks for any help!

21

Yes.

It excludes URLs that end in .local (you would have to adapt this to exclude your own local URLs if you don’t want to enforce SSL in your local dev environment.