How to Force HTTPS in Magento

HTTPS is essential for a secure Magento store. It encrypts communication between your customers and the server, protects login sessions, and helps prevent sensitive information from being intercepted.

Magento can be configured to use HTTPS for both the storefront and Admin Panel. You should also redirect HTTP requests to HTTPS at the web-server level so visitors cannot continue accessing the website through insecure URLs.

Why Force HTTPS in Magento?

Forcing HTTPS provides several benefits:

• Protects customer login information
• Secures administrator sessions
• Protects checkout traffic
• Prevents mixed-content problems
• Improves customer trust
• Supports modern browser security requirements
• Helps maintain consistent canonical URLs

A secure Magento website should generally use:

https://example.com

instead of:

http://example.com

---

1. Install an SSL Certificate

Before forcing HTTPS, your domain must have a valid SSL/TLS certificate.

You can obtain a certificate through your hosting provider or a certificate authority.

After installation, verify that:

https://example.com

opens successfully without certificate warnings.

Also test important pages such as:

• Homepage
• Category pages
• Product pages
• Customer login
• Cart
• Checkout
• Magento Admin

Do not force HTTPS until the certificate is working correctly.

---

2. Configure Magento Base URLs

Magento has separate configuration settings for the secure and unsecure base URLs.

From the Magento Admin Panel, go to:

Stores → Configuration → General → Web

Expand:

Base URLs

For a production HTTPS store, configure the Base URL using HTTPS:

https://example.com/

Then expand:

Base URLs (Secure)

Set:

Secure Base URL
https://example.com/

Make sure there is a trailing /.

---

3. Enable Secure URLs on the Storefront

Under:

Stores → Configuration → General → Web → Base URLs (Secure)

Set:

Secure Base URL

to:

https://example.com/

Then set:

Use Secure URLs on Storefront

to:

Yes

This tells Magento to generate storefront links using HTTPS.

---

4. Enable HTTPS for the Magento Admin

In the same Base URLs (Secure) section, set:

Use Secure URLs in Admin

to:

Yes

This ensures the Magento administrator interface uses HTTPS.

The Admin Panel should never be accessed over an insecure HTTP connection on a production store.

---

5. Configure HTTPS Using Magento CLI

You can also update the Magento base URLs from the command line.

From the Magento root directory:

php bin/magento setup:store-config:set \
--base-url-secure="https://example.com/"

Replace example.com with your actual domain.

You can also configure the secure base URL explicitly:

php bin/magento config:set web/secure/base_url "https://example.com/"

Enable secure storefront URLs:

php bin/magento config:set web/secure/use_in_frontend 1

Enable secure Admin URLs:

php bin/magento config:set web/secure/use_in_adminhtml 1

Then flush the Magento cache:

php bin/magento cache:flush

---

6. Redirect HTTP to HTTPS

Changing Magento’s base URL is not enough.

Someone could still visit:

http://example.com

unless the web server redirects HTTP requests.

You should configure a permanent redirect from HTTP to HTTPS.

The exact configuration depends on your web server.

---

7. Force HTTPS with Apache

If your Magento store uses Apache, an HTTP-to-HTTPS redirect can commonly be configured with .htaccess.

A typical redirect is:

RewriteEngine On

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Place the redirect in the appropriate HTTP virtual host or Magento .htaccess configuration according to your server setup.

Be careful when adding redirect rules to an existing Magento .htaccess file. Incorrect rules can cause redirect loops or interfere with Magento routing.

---

8. Force HTTPS with Nginx

If Magento is running behind Nginx, configure the HTTP server block to redirect requests to HTTPS.

For example:

server {
    listen 80;
    server_name example.com www.example.com;

    return 301 https://$host$request_uri;
}

Your HTTPS server block should then handle the secure Magento traffic.

After modifying Nginx configuration, test it:

nginx -t

If the test succeeds, reload Nginx:

systemctl reload nginx

---

9. Clear Magento Cache

After changing HTTPS configuration, flush Magento’s cache:

php bin/magento cache:flush

If you use Varnish or another caching system, clear or refresh that cache as well.

---

10. Check for Mixed Content

After enabling HTTPS, check your website for mixed-content warnings.

Mixed content occurs when an HTTPS page attempts to load resources using HTTP, for example:

http://example.com/media/image.jpg

instead of:

https://example.com/media/image.jpg

Common sources include:

• Images
• CSS
• JavaScript
• Fonts
• Third-party scripts
• Custom theme code
• Hard-coded URLs in extensions

Browser developer tools can help identify insecure resources.

---

11. Update Hard-Coded HTTP URLs

Search your Magento configuration, theme, extensions, and custom code for hard-coded HTTP URLs.

For example:

http://example.com/

should generally become:

https://example.com/

Be careful when performing database replacements. Always create a database backup first, and don’t blindly replace serialized Magento data with a basic SQL string replacement.

---

12. Check Magento Media URLs

Images and other media files should also load over HTTPS.

Check product pages, category pages, banners, and CMS content for HTTP URLs.

For example:

http://example.com/media/catalog/product/image.jpg

should be served securely through HTTPS.

---

13. Configure HTTPS Behind a CDN or Proxy

If your Magento store uses a CDN, reverse proxy, or load balancer, HTTPS configuration requires additional care.

The visitor may connect like this:

Customer
   ↓
HTTPS
   ↓
CDN / Proxy
   ↓
Magento Server

In this setup, Magento must correctly understand that the original visitor connection was HTTPS.

Incorrect proxy configuration can cause:

• Redirect loops
• Mixed content
• Incorrect URL generation
• Repeated HTTPS redirects

Make sure the proxy passes the appropriate HTTPS forwarding information to the Magento server.

---

14. Use HSTS Carefully

Once HTTPS is fully working, you can consider enabling HTTP Strict Transport Security (HSTS).

A typical header looks like:

Strict-Transport-Security: max-age=31536000

HSTS tells compatible browsers to use HTTPS for future requests.

However, don’t enable aggressive HSTS settings until you are certain that all required subdomains and resources are correctly configured for HTTPS. An incorrect HSTS configuration can make recovery more difficult.

---

15. Test the Entire Magento Store

After forcing HTTPS, don’t test only the homepage.

Check:

• Homepage
• Product pages
• Category pages
• Search
• Customer registration
• Customer login
• Cart
• Checkout
• Payment methods
• Shipping
• Contact forms
• CMS pages
• Magento Admin
• API integrations

Make sure every important function continues working.

---

Common HTTPS Problems

Redirect Loop

If the browser repeatedly redirects between HTTP and HTTPS, check:

• Magento secure URL configuration
• Nginx/Apache redirect rules
• CDN settings
• Reverse proxy configuration
• HTTPS forwarding headers

A proxy that terminates SSL but doesn’t correctly communicate the original protocol to Magento can commonly cause this problem.

Mixed Content Warning

Check your browser’s developer console and identify resources still being loaded through HTTP.

Update hard-coded URLs in themes, CMS content, and extensions.

Admin Panel Not Loading

Verify:

php bin/magento config:show web/secure/use_in_adminhtml

It should return an enabled value.

Also verify that your secure base URL is correct.

Too Many Redirects

Do not configure multiple independent HTTPS redirects at the CDN, web server, and Magento application without understanding how they interact.

Ideally, establish one clear redirect flow:

HTTP request
     ↓
Web server/CDN
     ↓
301 redirect
     ↓
HTTPS Magento URL

---

Magento HTTPS Checklist

Before considering the migration complete, verify:

• SSL/TLS certificate is valid
• Magento Base URL uses HTTPS
• Secure Base URL uses HTTPS
• Secure storefront URLs are enabled
• Secure Admin URLs are enabled
• HTTP redirects to HTTPS
• No mixed-content warnings exist
• Product images use HTTPS
• CSS and JavaScript use HTTPS
• Checkout works correctly
• Payment methods work correctly
• Admin Panel works correctly
• CDN/proxy HTTPS configuration is correct
• Magento cache has been flushed
• Varnish/CDN cache has been refreshed if applicable
• HTTPS redirects have been tested

Conclusion

Forcing HTTPS in Magento involves more than installing an SSL certificate. You need to configure Magento’s secure URLs, enable HTTPS for the storefront and Admin Panel, redirect HTTP requests, and eliminate mixed-content problems.

The basic Magento configuration can be handled with:

php bin/magento config:set web/secure/base_url "https://example.com/"
php bin/magento config:set web/secure/use_in_frontend 1
php bin/magento config:set web/secure/use_in_adminhtml 1
php bin/magento cache:flush

Then configure your web server or CDN to permanently redirect HTTP traffic to HTTPS.

Once HTTPS is working correctly across the entire store, consider additional protections such as HSTS, a WAF, strong administrator authentication, and regular security updates.