Simple and easy way to force HTTPS on entire site

[Hostnetric]

I tried to figure this out myself for a couple of days. Looked on forums here and at other forums.

 

The problem I ran into is that custom pages never would go to https.

 

I had https set in whmcs like normal, but this only works for the admin areas and not custom pages.

 

The solution is simple and easy.

 

First turn off the https in your general settings tab. Do not add the https version of your domain.

 

Next add this to your .htaccess

 

RewriteEngine On

RewriteCond %{HTTPS} off

RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

 

If you already have RewriteEngine On in your .htaccess simply copy and paste this directly below it.

 

RewriteCond %{HTTPS} off

RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

 

You can see how it works on my site I am working on that is in my signature.

 

BTW if you do not remove the https://www.yourdomain.com from the whmcs you will get an error that says there are to many redirects for ssl. Just clear that line in your general settings and you will be fine.

 

 

Simple and easy. I hope this helps anyone that has struggled with this like I have. Let me know how this works for you.

 

 

 

Kevin

[Hostnetric]

This was shared with me by Jack from Zomex and TemplateGenie. He noticed one thing with this method in relation to older themes.

 

This will only work for updated templates running the Six WHMCS template or a custom template that was recently integrated with Six. The reason is the new version uses relative paths for all URLs, old ones use the system URL in the head so if it's redirecting to https:// the line will cause everything to load as http:// so it'll cause a redirect error.

 

But that's only for old templates, so it's a good solution and will become even better as soon enough everyone will be running updated templates.

 

 

Thanks for sharing this Jack. Although this will help many people out there still.

[HostGarou]

We had also this issue, we have had an htaccess redirection from http to https for the entire website, but some whmcs pages was running on http. This a whmcs issue though, and you will need to wait until a fix is released.

 

However, the solution is pretty simple, go the the General setting under whmcs, remove the url from WHMCS SSL System URL, then add the HTTPS:// in the WHMCS System URL . That's it. No htaccess headache now.

[twhiting9275]

However, the solution is pretty simple, go the the General setting under whmcs, remove the url from WHMCS SSL System URL, then add the HTTPS:// in the WHMCS System URL . That's it. No htaccess headache now.

This may have been true and accurate in v5, but not so in v6.

In v6, WHMCS made some sort of change to how the SystemURL hndles things, and sometimes it will, sometimes it won't load the site in https, depending on the weather, the mood of the script, etc... This has been known for quite some time.

 

Hostentric's method is the only sure fire way, 100% of the time to serve up SSL without any sort of issue.

 

I will add to Hostentric's post that if you've got 'force admin SSL' on, you need to turn that off. It's pointless with a force .htaccess redirect anyways

[HostGarou]

I will add to Hostentric's post that if you've got 'force admin SSL' on, you need to turn that off. It's pointless with a force .htaccess redirect anyways

 

Indeed, a perfect https redirection would be first to check if the SSL is already ON before redirecting to HTTPS. We have this code in our httaccess :

 

## Moving to HTTPS ##

RewriteEngine On

RewriteCond %{HTTPS} !=on

# This checks to make sure the connection is not already HTTPS

RewriteCond %{HTTP_HOST} ^(www\.)?YOURDOMAIN\.com$ [NC]

RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

 

You can just copy and past this code if you're looking to run the SSL on the entire site. Just replace YOURDOMAIN with yours

 

The code is self explanatory, we're also running the V6 on our production and we have now issue at all when tweaking the WHMCS system URL and put HTTPS rather than HTTP, and every single page under WHMCS runs on SSL.

[twhiting9275]

Not in v6 it doesn't

[HostGarou]

Not in v6 it doesn't

 

You can check our whmcs installation to check this out

[Hostnetric]

The ssl will work for most of the pages through the backend method, but currently it doesn't work on all pages such as those that are custom pages. No matter what you do if you get the desired result that is great and sharing these ideas is important. Hopefully this will be fixed in a later update.

[ScottN]

As a data point... this did not work for us. The problem is that we use Authorize.net as our Payment Gateway provider. Their module relies on the "WHMCS SSL System URL" setting... if we blank that out, per the above instructions, then the viewinvoice template includes a non-https payment button, which causes mixed content errors. Ultimately, when customers would try to pay their bill with a credit card, it would take them back to the Client Dashboard instead of the credit card payment form. i.e. big problem.

 

So, it's back to non-https for us. Oh well, who needs https on a billing system anyway.

 

- Scott

[ScottN]

OK, an update here. I opened a ticket with WHMCS on this, and they suggested a slightly different method to get this to work and it does appear to be working:

 

For Version 6, to force SSL on all pages, you would want to change your "WHMCS System URL" to your SSL address and then leave your "WHMCS SSL System URL" blank. This would force the SSL site by default.

 

So, here is what I had, what I tried, and finally what worked...

 

ORIGINAL CONFIG:

WHMCS System URL: http://www.example.com/

WHMCS SSL System URL: https://www.example.com/

 

FIRST WAY I TRIED (using above instructions to remove https URL, which did not work):

WHMCS System URL: http://www.example.com/

WHMCS SSL System URL: (leave Blank)

 

WORKING CONFIG (per WHMCS Support suggestion):

WHMCS System URL: https://www.example.com/

WHMCS SSL System URL: (leave Blank)

 

While WHMCS Support didn't mention the .htaccess changes, I had to put them in place or the site didn't go all https all the time.

 

They also mentioned some changes in Version 7:

 

In Version 7, we eliminated the 2 separate fields for non-SSL and SSL WHMCS URLs. They are now merged into a single field and should default to the SSL address. This change was made for simplicity but also in response to the upcoming Google Chrome non-secure alerts.

 

Hope this helps.

 

- Scott

[twhiting9275]

For Version 6, to force SSL on all pages, you would want to change your "WHMCS System URL" to your SSL address and then leave your "WHMCS SSL System URL" blank. This would force the SSL site by default.

This is not correct. It used to be that this would happen as you suggested, but somewhere with v6, it got broken, as you noticed with .htaccess changes

 

 

In Version 7, we eliminated the 2 separate fields for non-SSL and SSL WHMCS URLs. They are now merged into a single field and should default to the SSL address. This change was made for simplicity but also in response to the upcoming Google Chrome non-secure alerts.

This is 100% correct, though I haven't actually tested that it works like it did in 5.x. Haven't bothered to remove the .htaccess bits. Just no reason to do so, they don't harm anything.

[ScottN]

This is not correct. It used to be that this would happen as you suggested, but somewhere with v6, it got broken, as you noticed with .htaccess changes

 

I'll update my ticket with this info, thanks! I do agree with you... it didn't work as they said it would.

 

- Scott