There are numerous ways these days you can solve this. The first one I would recommend is making sure that you have set Strict-Transport-Security, you can do this in your .htaccess file like this:
Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS
You can also set your Content-Security-Policy, one of the values is for making sure http requests get upgraded to https. There is much more you can do with content security policies, I would recommend reading up on that, but at the very minimum and to help solve your problem you would want to set something like this in your .htaccess file.
Header always set Content-Security-Policy "upgrade-insecure-requests"
For these headers you could also set these in PHP directly (instead of htaccess):
header('Strict-Transport-Security: max-age=31536000');
header('Content-Security-Policy: upgrade-insecure-requests');
Finally another way is to create a RewriteRule in your .htaccess file:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]
You can use one or more of these methods simultaneously. I usually keep the RewriteRule in case older browsers or bots don't understand or support the other directives.
-
0
In Firefox you can also enable HTTPS-Only Mode to redirect to HTTP. In the menu bar at the top of the screen, click and select Settings, Select Privacy & Security from the left menu. Scroll down towards the bottom where it says HTTPS-Only Mode. Use the radio button to select whether to enable or disable HTTPS-Only Mode, or select to only enable it for private windows.
— Lehigh HVAC
add a comment