# Https .htaccess

**URL:** <https://forum.getkirby.com/t/https-htaccess/19568>\
**Category:** Questions\
**Tags:** v3\
**Created:** [September 30, 2020, 8:32am UTC](https://forum.getkirby.com/t/https-htaccess/19568 "2020-09-30T08:32:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![coolcoolhomebody](https://avatars.discourse-cdn.com/v4/letter/c/8e8cbc/32.png) [@coolcoolhomebody](https://forum.getkirby.com/u/coolcoolhomebody)\
**Post date:** [September 30, 2020, 8:32am UTC](https://forum.getkirby.com/t/https-htaccess/19568/1 "2020-09-30T08:32:54Z")

</div>

I use kirby starterkit.  
How can I write it when I want to force http to https?  
I looked for other articles, but it was written in partial code, so I don’t know how to fix it.

```auto

# Kirby .htaccess

# rewrite rules
<IfModule mod_rewrite.c>

# enable awesome urls. i.e.:
# http://yourdomain.com/about-us/team
RewriteEngine on

# make sure to set the RewriteBase correctly
# if you are running the site in a subfolder.
# Otherwise links or the entire site will break.
#
# If your homepage is http://yourdomain.com/mysite
# Set the RewriteBase to:
#
# RewriteBase /mysite

# In some environments it's necessary to
# set the RewriteBase to:
#
# RewriteBase /

# block files and folders beginning with a dot, such as .git
# except for the .well-known folder, which is used for Let's Encrypt and security.txt
RewriteRule (^|/)\.(?!well-known\/) index.php [L]

# block text files in the content folder from being accessed directly
RewriteRule ^content/(.*)\.(txt|md|mdown)$ index.php [L]

# block all files in the site folder from being accessed directly
# except for requests to plugin assets files
RewriteRule ^site/(.*) index.php [L]

# Enable authentication header
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

# block direct access to kirby and the panel sources
RewriteRule ^kirby/(.*) index.php [L]

# make site links work
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*) index.php [L]

</IfModule>

# compress text file responses
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE application/json
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

```

---

<div class="post-metadata">

**Author:** ![ahmetbora](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ahmetbora/32/11671_2.png) [@ahmetbora](https://forum.getkirby.com/u/ahmetbora)\
**Post date:** [September 30, 2020, 9:14am UTC](https://forum.getkirby.com/t/https-htaccess/19568/2 "2020-09-30T09:14:30Z")

</div>

Here my .htaccess file that included all redirects type. Just uncomment line.

```auto
# Kirby .htaccess

# rewrite rules
<IfModule mod_rewrite.c>

# enable awesome urls. i.e.:
# http://yourdomain.com/about-us/team
RewriteEngine on

# make sure to set the RewriteBase correctly
# if you are running the site in a subfolder.
# Otherwise links or the entire site will break.
#
# If your homepage is http://yourdomain.com/mysite
# Set the RewriteBase to:
#
# RewriteBase /mysite

# In some environments it's necessary to
# set the RewriteBase to:
#
# RewriteBase /

# https redirect
# RewriteCond %{HTTP:X-Forwarded-Proto} !https
# RewriteCond %{HTTPS} off
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# force www without ssl
# RewriteCond %{HTTPS} off
# RewriteCond %{HTTP_HOST} !^www\..+$ [NC]
# RewriteCond %{HTTP_HOST} (.+)$ [NC]
# RewriteRule ^(.*)$ http://www.%1/$1 [R=301,L]

# force www with ssl
# RewriteCond %{HTTP_HOST} !^www\..+$ [NC]
# RewriteCond %{HTTP_HOST} (.+)$ [NC]
# RewriteRule ^(.*)$ https://www.%1/$1 [R=301,L]

# force non-www without ssl
# RewriteCond %{HTTPS} off
# RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
# RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

# force non-www with ssl
# RewriteCond %{HTTPS} on
# RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
# RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

# redirect www all except subdomains
# RewriteCond %{HTTP_HOST} !^(.*)\.(.*)\. [NC]
# RewriteCond %{HTTPS}s ^on(s)|
# RewriteRule ^ http%1://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# block files and folders beginning with a dot, such as .git
# except for the .well-known folder, which is used for Let's Encrypt and security.txt
RewriteRule (^|/)\.(?!well-known\/) index.php [L]

# block text files in the content folder from being accessed directly
RewriteRule ^content/(.*)\.(txt|md|mdown)$ index.php [L]

# block all files in the site folder from being accessed directly
# except for requests to plugin assets files
RewriteRule ^site/(.*) index.php [L]

# Enable authentication header
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

# block direct access to kirby and the panel sources
RewriteRule ^kirby/(.*) index.php [L]

# make site links work
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*) index.php [L]

</IfModule>

# Additional recommended values
# Remove comments for those you want to use.
#
# AddDefaultCharset UTF-8
#
# php_flag short_open_tag on

# ==== GZIP =====
<ifmodule mod_deflate.c>
	# compress text, html, javascript, css, xml:
	AddOutputFilterByType DEFLATE text/plain
	AddOutputFilterByType DEFLATE text/html
	AddOutputFilterByType DEFLATE text/xml
	AddOutputFilterByType DEFLATE text/css
	AddOutputFilterByType DEFLATE text/javascript
	AddOutputFilterByType DEFLATE application/xml
	AddOutputFilterByType DEFLATE application/xhtml+xml
	AddOutputFilterByType DEFLATE application/rss+xml
	AddOutputFilterByType DEFLATE application/json
	AddOutputFilterByType DEFLATE application/javascript
	AddOutputFilterByType DEFLATE application/x-javascript
	AddOutputFilterByType DEFLATE application/x-font-woff
	AddOutputFilterByType DEFLATE application/x-font-woff2

	# Or, compress certain file types by extension:
	<files *.html>
		SetOutputFilter DEFLATE
	</files>
</ifmodule>
# ==== GZIP END =====

<ifmodule mod_deflate.c>
	<ifmodule mod_setenvif.c>
		<ifmodule mod_headers.c=>
		SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
		RequestHeader append Accept-Encoding &quot;gzip,deflate&quot; env=HAVE_Accept-Encoding
		</ifmodule>
	</ifmodule>
</ifmodule>

<IfModule mod_headers.c>
	<FilesMatch "\.(ico|pdf|flv|mp4|ogg|webm|jpg|jpeg|png|gif|js|css|swf|eot|font.css|otf|ttc|ttf|woff|woff2|svg|zip)$">
		Header set Cache-Control "max-age=604800, public"
	</FilesMatch>

	<FilesMatch "\.(html|htm|xml|txt)$">
		Header set Cache-Control "max-age=86400, public, must-revalidate"
	</FilesMatch>
</IfModule>

# ######################################################################
# # MEDIA TYPES AND CHARACTER ENCODINGS #
# ######################################################################

# ----------------------------------------------------------------------
# | Media types |
# ----------------------------------------------------------------------

# Serve resources with the proper media types (f.k.a. MIME types).
#
# https://www.iana.org/assignments/media-types/media-types.xhtml
# https://httpd.apache.org/docs/current/mod/mod_mime.html#addtype

<IfModule mod_mime.c>

  # Data interchange

    AddType application/atom+xml atom
    AddType application/json json map topojson
    AddType application/ld+json jsonld
    AddType application/rss+xml rss
    AddType application/vnd.geo+json geojson
    AddType application/xml rdf xml

  # JavaScript

    # Normalize to standard type.
    # https://tools.ietf.org/html/rfc4329#section-7.2

    AddType application/javascript js

  # Manifest files

    # If you are providing a web application manifest file (see
    # the specification: https://w3c.github.io/manifest/), it is
    # recommended that you serve it with the `application/manifest+json`
    # media type.
    #
    # Because the web application manifest file doesn't have its
    # own unique file extension, you can set its media type either
    # by matching:
    #
    # 1) the exact location of the file (this can be done using a
    # directive such as `<Location>`, but it will NOT work in
    # the `.htaccess` file, so you will have to do it in the main
    # server configuration file or inside of a `<VirtualHost>`
    # container)
    #
    # e.g.:
    #
    # <Location "/.well-known/manifest.json">
    # AddType application/manifest+json json
    # </Location>
    #
    # 2) the filename (this can be problematic as you will need to
    # ensure that you don't have any other file with the same name
    # as the one you gave to your web application manifest file)
    #
    # e.g.:
    #
    # <Files "manifest.json">
    # AddType application/manifest+json json
    # </Files>

    AddType application/x-web-app-manifest+json webapp
    AddType text/cache-manifest appcache

  # Media files

    AddType audio/mp4 f4a f4b m4a
    AddType audio/ogg oga ogg opus
    AddType image/bmp bmp
    AddType image/svg+xml svg svgz
    AddType image/webp webp
    AddType video/mp4 f4v f4p m4v mp4
    AddType video/ogg ogv
    AddType video/webm webm
    AddType video/x-flv flv

    # Serving `.ico` image files with a different media type
    # prevents Internet Explorer from displaying then as images:
    # https://github.com/h5bp/html5-boilerplate/commit/37b5fec090d00f38de64b591bcddcb205aadf8ee

    AddType image/x-icon cur ico

  # Web fonts

    AddType application/font-woff woff
    AddType application/font-woff2 woff2
    AddType application/vnd.ms-fontobject eot

    # Browsers usually ignore the font media types and simply sniff
    # the bytes to figure out the font type.
    # https://mimesniff.spec.whatwg.org/#matching-a-font-type-pattern
    #
    # However, Blink and WebKit based browsers will show a warning
    # in the console if the following font types are served with any
    # other media types.

    AddType application/x-font-ttf ttc ttf
    AddType font/opentype otf

  # Other

    AddType application/octet-stream safariextz
    AddType application/x-bb-appworld bbaw
    AddType application/x-chrome-extension crx
    AddType application/x-opera-extension oex
    AddType application/x-xpinstall xpi
    AddType text/vcard vcard vcf
    AddType text/vnd.rim.location.xloc xloc
    AddType text/vtt vtt
    AddType text/x-component htc

</IfModule>

# ----------------------------------------------------------------------
# | Reducing MIME type security risks |
# ----------------------------------------------------------------------

# Prevent some browsers from MIME-sniffing the response.
#
# This reduces exposure to drive-by download attacks and cross-origin
# data leaks, and should be left uncommented, especially if the server
# is serving user-uploaded content or content that could potentially be
# treated as executable by the browser.
#
# http://www.slideshare.net/hasegawayosuke/owasp-hasegawa
# http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx
# https://msdn.microsoft.com/en-us/library/ie/gg622941.aspx
# https://mimesniff.spec.whatwg.org/

<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
</IfModule>

# ----------------------------------------------------------------------
# | ETags |
# ----------------------------------------------------------------------

# Remove `ETags` as resources are sent with far-future expires headers.
#
# https://developer.yahoo.com/performance/rules.html#etags
# https://tools.ietf.org/html/rfc7232#section-2.3

# `FileETag None` doesn't work in all cases.
<IfModule mod_headers.c>
    Header unset ETag
</IfModule>

FileETag None

# ----------------------------------------------------------------------
# | Expires headers |
# ----------------------------------------------------------------------

# Serve resources with far-future expires headers.
#
# (!) If you don't control versioning with filename-based
# cache busting, you should consider lowering the cache times
# to something like one week.
#
# https://httpd.apache.org/docs/current/mod/mod_expires.html

<IfModule mod_expires.c>

    ExpiresActive on
    ExpiresDefault "access plus 1 month"

  # CSS
    ExpiresByType text/css "access plus 1 year"

  # Data interchange
    ExpiresByType application/atom+xml "access plus 1 hour"
    ExpiresByType application/rdf+xml "access plus 1 hour"
    ExpiresByType application/rss+xml "access plus 1 hour"

    ExpiresByType application/json "access plus 0 seconds"
    ExpiresByType application/ld+json "access plus 0 seconds"
    ExpiresByType application/schema+json "access plus 0 seconds"
    ExpiresByType application/vnd.geo+json "access plus 0 seconds"
    ExpiresByType application/xml "access plus 0 seconds"
    ExpiresByType text/xml "access plus 0 seconds"

  # Favicon (cannot be renamed!) and cursor images
    ExpiresByType image/vnd.microsoft.icon "access plus 1 week"
    ExpiresByType image/x-icon "access plus 1 week"

  # HTML
    ExpiresByType text/html "access plus 0 seconds"

  # JavaScript
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType application/x-javascript "access plus 1 year"
    ExpiresByType text/javascript "access plus 1 year"

  # Manifest files
    ExpiresByType application/manifest+json "access plus 1 year"

    ExpiresByType application/x-web-app-manifest+json "access plus 0 seconds"
    ExpiresByType text/cache-manifest "access plus 0 seconds"

  # Media files
    ExpiresByType audio/ogg "access plus 1 month"
    ExpiresByType image/bmp "access plus 1 month"
    ExpiresByType image/gif "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType image/webp "access plus 1 month"
    ExpiresByType video/mp4 "access plus 1 month"
    ExpiresByType video/ogg "access plus 1 month"
    ExpiresByType video/webm "access plus 1 month"

  # Web fonts

    # Embedded OpenType (EOT)
    ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
    ExpiresByType font/eot "access plus 1 month"

    # OpenType
    ExpiresByType font/opentype "access plus 1 month"

    # TrueType
    ExpiresByType application/x-font-ttf "access plus 1 month"

    # Web Open Font Format (WOFF) 1.0
    ExpiresByType application/font-woff "access plus 1 month"
    ExpiresByType application/x-font-woff "access plus 1 month"
    ExpiresByType font/woff "access plus 1 month"

    # Web Open Font Format (WOFF) 2.0
    ExpiresByType application/font-woff2 "access plus 1 month"

  # Other
    ExpiresByType text/x-cross-domain-policy "access plus 1 week"

</IfModule>

```

---

<div class="post-metadata">

**Author:** ![ktryn](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/ktryn/32/12108_2.png) [@ktryn](https://forum.getkirby.com/u/ktryn)\
**Post date:** [January 22, 2021, 6:11am UTC](https://forum.getkirby.com/t/https-htaccess/19568/3 "2021-01-22T06:11:45Z")

</div>

Thanks! Amazing httaccess file btw 😄