Enforcing HTTPS

Chapter 2 — Enforcing HTTPS

Installing a certificate (Chapter 1) makes HTTPS available — but it doesn't stop users arriving over plain HTTP. A visitor who types osztromok.com without the https://, follows an old bookmark, or clicks a link from an older site will make their first request over HTTP. That first request is unencrypted, and could include cookies or credentials. Enforcing HTTPS means redirecting HTTP traffic to HTTPS before any content is served — and then using HSTS to tell browsers to never attempt HTTP again.

Why a Certificate Alone Is Not Enough

The redirect is a 301 Permanent Redirect, not a 302 Temporary. The permanent status tells browsers and search engines that HTTP is never the right choice for this domain. Search engines consolidate SEO signals to the HTTPS version, and browsers cache the redirect so repeat visitors skip the HTTP round-trip entirely.

Three Ways to Redirect HTTP to HTTPS in Apache

Method 1 — Redirect directive

Method 2 — mod_rewrite (for Flexible SSL or conditional logic)

Cloudflare "Always Use HTTPS"

This is the cleanest solution if all traffic goes through Cloudflare. The redirect happens at Cloudflare's edge — the HTTP request never touches your server. Enable it in the Cloudflare dashboard:

SSL/TLS → Edge Certificates → Always Use HTTPS → toggle On

When enabled, a visitor who requests http://osztromok.com gets a 301 redirect to https://osztromok.com from Cloudflare's servers directly. Your Apache config doesn't need a redirect at all — the *:80 VirtualHost can simply return a 404 or be left as-is.

The Redirect Loop Trap

This is the most common mistake when adding HTTPS redirects behind Cloudflare, and it produces the browser error ERR_TOO_MANY_REDIRECTS.

HSTS — HTTP Strict Transport Security

A redirect upgrades the current HTTP request to HTTPS. HSTS goes further: it tells the browser to never attempt HTTP for this domain again — for a specified duration. The browser enforces HTTPS locally, before making any network request, so there's no HTTP exposure even on the first visit after the cached instruction is set.

This eliminates the "HTTPS downgrade attack" window — the brief moment during the first HTTP request before the redirect fires, when an attacker on the same network could intercept or modify the traffic.

HSTS Header Parameters

Configuring HSTS in Apache

HSTS is set via the Strict-Transport-Security response header, added by mod_headers. It must be in the *:443 VirtualHost only — browsers ignore this header on plain HTTP responses (rightly so, since an attacker on HTTP could strip it).

Progressively hardening HSTS

Don't jump straight to a 1-year HSTS with preload — if anything breaks, you're locked in for a very long time. Work through this progression over weeks:

HSTS Preload List

The HSTS preload list is a database maintained by Google (and used by Chrome, Firefox, Safari, Edge) that hardcodes domains as HTTPS-only directly in the browser binary. Even a brand new browser that has never visited your site will refuse to make HTTP requests to a preloaded domain.

Complete Setup Walkthrough

X-Forwarded-Proto — Reading the Real Protocol

When traffic passes through a proxy (Cloudflare, a load balancer, another reverse proxy), the proxy adds an X-Forwarded-Proto header to tell the backend what protocol the original client used — even if the proxy changed it en route.

This is why the mod_rewrite method (Method 2) works correctly with Flexible SSL — it checks X-Forwarded-Proto before deciding whether to redirect. The simple Redirect permanent doesn't do this check, which is why it causes loops in Flexible mode.

Troubleshooting

Quick Reference — Chapter 2