Remove www From URLs and Force HTTPS With .htaccess

These Apache rewrite rules send every request for the www version of your domain to the bare domain over HTTPS, and move plain http:// requests without www to HTTPS as well, using permanent (301) redirects. For example, http://www.example.com/shop/, https://www.example.com/shop/ and http://example.com/shop/ all end up at https://example.com/shop/ in a single redirect. It works on any site hosted on Apache with mod_rewrite, WordPress included.

Add the code to the .htaccess file in your site’s root folder. On a WordPress site, put it above the # BEGIN WordPress block so it runs before the WordPress rules.

RewriteEngine on
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1%{REQUEST_URI} [R=301,QSA,NC,L]
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,QSA,NC,L]

How it works

• RewriteEngine on switches on URL rewriting.
• The first RewriteCond lets the rule below it run only when the host name starts with www.. The (.*) part captures the rest of the host, such as example.com, and [NC] makes the match case-insensitive.
• That RewriteRule redirects to https:// plus the captured host (%1) and the requested path (%{REQUEST_URI}). R=301 makes the redirect permanent and L stops processing further rules for this request. A query string such as ?page=2 is carried over.
• The second pair catches the requests that are left. %{HTTPS} is off when the connection doesn’t use SSL, so a plain http://example.com request is redirected to https:// with the same host and path.
• Together they cover all four cases: http with www and https with www go straight to https://example.com through the first rule, http without www goes there through the second, and https without www isn’t redirected.

Before you use it

• If HTTPS ends at a proxy, load balancer or CDN in front of Apache, Apache receives plain http and %{HTTPS} is always off, so the second rule would redirect in a loop. In that setup, use your host’s or CDN’s force-HTTPS setting instead of the second rule.
• Your SSL certificate must cover the domain without www, and the www version too: the browser checks the certificate for https://www.example.com before it gets the redirect.
• In WordPress, set both addresses under Settings > General to the https version without www. If they still contain www, WordPress redirects back and you end up in a redirect loop.
• Back up .htaccess before you edit it. Browsers cache 301 redirects, so test in a private window.
• Nginx doesn’t read .htaccess; there you need an equivalent rule in the server configuration.

Related articles

• WordPress security rules for .htaccess: blocking xmlrpc.php, PHP in uploads and directory listings
• browser caching headers in .htaccess: Expires rules that live in the same file