> For the complete documentation index, see [llms.txt](https://docs.phptravels.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.phptravels.com/startup/ssl-force.md).

# SSL Force

Force HTTPS on your PHPTRAVELS website: the .htaccess rules that redirect every HTTP request to SSL, the checks to run after and fixes for redirect loops.

{% hint style="info" %}
**Make sure you have deployed the product before performing this solution**
{% endhint %}

Edit the file on your root public folder **.htaccess** and replace the below code. 

This will force your website to load over https only 

```
RewriteEngine On 
RewriteCond %{HTTPS} off 
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule ^(.+)$ index.php?url=$1 [QSA,L]
```

### Why force HTTPS

A travel booking site handles passenger names, passport details and payments, so every page should load over HTTPS. Browsers mark plain HTTP pages as "Not secure", payment gateways expect HTTPS return URLs, and search engines prefer the secure version. The rules above send any HTTP request to the same address on HTTPS with a permanent (301) redirect, then pass the request to PHPTRAVELS as usual.

### Before you start

* PHPTRAVELS is installed and working on your domain.
* A valid SSL certificate is active for the domain. Most hosts offer a free certificate in the control panel; ask your host if you are unsure.
* You can edit files in the website's root public folder (for example `public_html`) through your file manager or FTP.

### Steps

1. Open `https://yourdomain.com` in a browser and confirm the padlock shows. If the certificate is not valid, fix that first; forcing HTTPS without a certificate makes the site unreachable.
2. Back up the current `.htaccess` file in the root public folder.
3. Replace its content with the rules shown above and save.
4. Make sure the **Base URL** of your site uses `https://`, so links and assets load securely.
5. Clear any server or CDN cache.

### How to test

* Visit `http://yourdomain.com` and check that the browser lands on `https://yourdomain.com`.
* Open a deeper page with `http://`, for example a hotel or flight results page, and confirm it also switches to HTTPS.
* Check the browser console for "mixed content" warnings about images or scripts still on HTTP.
* Make a test payment to confirm the gateway returns to the HTTPS site.

### Common errors

* **Too many redirects** -- a CDN or proxy (such as Cloudflare in "Flexible" SSL mode) talks to your server over HTTP. Set it to "Full" SSL or remove the duplicate redirect.
* **500 error after saving** -- a typo in `.htaccess`; restore the backup and paste the rules again.
* **Padlock missing on some pages** -- assets are hard-coded with `http://`; update them to `https://`.