Htaccess rule for apache server requested

[born2run]

Hi so I'm setting up a new site after a few months, and I want the following to happen via htaccess:

My primary url is

https://www.domain.com

1.

https://domain.com

to goto my primary url above.
2.

http://domain.com

goto primary url.
3.

http://www.domain.com

goto primary url.

I google searched and found the following code:

====
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ [%{HTTP_HOST}%{REQUEST_URI}...] [L,R=301]
====

I don't think the above code will handle

https://domain.com

? Can anyone please check and correct the rule above? Apologies for the format of the text. Thanks much!

[w3dk]

That's an HTTP to HTTPS redirect only. (However, that would be required if you were intending to get on the HSTS preload list, ie. redirect to HTTPS on the same host before canonicalising the hostname.)

You could either supplement that rule with a second rule that handles the non-www to www part. For example:

# non-www to www redirect
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

(If you reverse the 2 rules then you'll only get at most 1 redirect - not 2.)

Or, combine the two into one single redirect:

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L]

If you specifically want a "general" solution that doesn't explicitly mention the domain name then:

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\.
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+?)\.?$ [NC]
RewriteRule ^ https://www.%1%{REQUEST_URI} [R=301,L]

Note that all these assume you don't have any other subdomains. And that the SSL cert is installed on your application server and not handled by some intermediary proxy (in which case the HTTPS server variable will always likely be "off").

[lucy24]

https://www.domain.com

Use example.com.

Use example.com.

Use example.com.

The canonicalization redirect has been discussed, at rough estimate, 80,000 times in this subforum, with the optimal code posted, again at rough estimate, 10,000 of those times.

I like to include an initial RewriteCond

RewriteCond %{REQUEST_URI} !^/robots\.txt

because I’ve seen some robots get confused if a robots.txt request is redirected, and you don’t want to give them any excuse to say “But I tried to get robots.txt ::whine:: honest I did”.

[lammert]

"Optimal" solutions are not static, and what once was considered the best way to do something may have changed over time.

Especially, some years ago the recommendation was to go to the final URL in just one 301 redirect to prevent link juice to dilute too much. Every 301 redirect would eat a certain amount of link juice and too many redirects in sequence would affect the ranking in the SERPs. At that moment in time, the recommendation was

http://example.com ==> https://www.example.com

But Google removed the link juice dilution with 301 redirects some time ago and instead started to push the HSTS preload list. To get on the HSTS preload list you have to redirect from http to https without a secondary DNS lookup as @w3dk correctly mentioned. Therefore now the recommended sequence has changed to:

http://example.com ==> https://example.com ==> https://www.example.com

I do not know if Google is currently already using inclusion on the HSTS preload list as a signal for better ranking in the SERPs, but knowing how Google is pushing secure sites, I have no doubt that somewhere in the future they will use the HSTS preload list in some way to rank URLs in the SERPs.

If you use a TLD which is maintained by Google like the .app TLD, you have no choice because Google adds domains on their own TLDs to the HSTS preload list automatically and not using the two-step redirect may cause your site to become inaccessible for some users.

[lucy24]

the recommendation was to go to the final URL in just one 301 redirect to prevent link juice to dilute too much

I must take issue with this. The primary reason for doing any redirect--of which hostname canonicalization is only one subset--in a single step was to save work for the server. It potentially also saves response time for users with slow connections (or, worst case, sites with slow servers).

[phranque]

https://www.domain.com

Use example.com.

Use example.com.

Use example.com.

hence this pinned thread atop the Apache Web Server forum listing:
IMPORTANT: Please Use Example.com For Domain Names in Posts [webmasterworld.com]

[born2run]

Ok sorry about the domain name! I will be using this code as per w3dk:

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L]