Ugh, seems like I'm having a lot of htaccess issues lately. Recently moved a client site to new hosting from the cient's internal server. Their IT had setup SSL and updated the .htaccess to redirect http://site.com/login to https://site.com/login. This .htaccess file causes a "too many redirects" error. I've done a lot of trial and error testing on this and the results are always the same. I even found Adding a .htaccess redirect to https that plays nicely with existing EE .htaccess rules and tried that exact working htaccess file and got the same results. Any ideas?

RewriteEngine On

# Remove trailing slashes
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)/$ /$1 [R=301,L]

# Redirect certain site pages to SSL and vice-versa
RewriteCond %{REQUEST_URI} !(login|themes|images|assets)
RewriteCond %{QUERY_STRING} !^(ACT=.*)$ [NC]
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

RewriteCond %{REQUEST_URI} (login)
RewriteCond %{HTTPS} !=on
#RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

# Remove index.php from URLs
RewriteCond $1 !(^index\.php|(\.(gif|jpe?g|png|css|js)))$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]

I've commented out everything but this and still have the same issue...

RewriteCond %{REQUEST_URI} (login)
RewriteCond %{HTTPS} !=on
#RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

2 Answers 2


I've run into similar issues in the past, and honestly I gave up on htaccess in the end as I never could get it to work exactly as I intended.

A much easier solution I found was using an add on to force the redirect instead, doing it this way I gained direct control of pages needed redirecting in templates instead.

I used an addon called Force SSL, http://devot-ee.com/add-ons/force-ssl

You just pop {exp:force_ssl} in the page you want to be secured and your set. In my case I wanted some pages to not be secured too, so for that I just use {exp:force_ssl:restore}


Okay as it's still giving you the error when using other methods to redirect, this suggests to me there's something else causing the problems here. Just do this test for me. Remove all the ssl rules from htaccess, and also any occurrences of the Force SSL addon. Then goto any page on the site, but for SSL by putting https:// in the URL.

What I suspect is in this case it will redirect back to http:// from https://

If it does this then what's likely happening is there's something in the web server forcing insecure connections. This would be why you get too many redirects as it would just switch back and forth between the too hence the too many redirects error.

If it is this, just get in touch with your web host or whoever administers yoru server to get them to look into that as it's likely a config you don't have access too.

  • I gave the plugin a try and I get the same "too many redirects" error :/ Oct 11, 2013 at 20:38
  • Just updated my answer with a new idea
    – neekster
    Oct 12, 2013 at 2:16
  • tried viewing a https page and it did not redirect to http. So things appear to be working there ok. Thanks for the idea. Oct 14, 2013 at 13:26
  • Another suggestion, just to eliminate anything EE from the picture, remove EE altogether by just doing the test with some static HTML files, redirecting to HTTPS etc on the static html. This will tell you if the issue lies solely on the underlying hosting configuration/htaccess or if something in your EE setup is contributing to the problem.
    – neekster
    Oct 16, 2013 at 1:23
  • neekster, thanks for hanging in there with me! I uploaded a static html file and it works at both site.com/test.html and site.com/test.html. So it must be something to do with the htaccess and EE, probably both. I'm going to do some more trial and error testin with the htaccess file, even though I'm sure I tested the htaccess with everything commented out besides the ssl redirect and it still had problems. Thanks! Oct 16, 2013 at 13:24

I've had similar issues; after discussion with our sys-admin, we determined that if you need anything on a site served with SSL (like a login page), you probably want the entire site served with SSL. Assuming everything you're serving on the front-end can be downloaded of HTTPS, that shouldn't be an issue. It adds some overhead, but, it's trivial, and doing so will prevent a few different attack vectors that you otherwise leave open when not securing the entire site.

In summary, turn on SSL for the whole site if you can. If that's not an option, I can throw a few minutes at your .htaccess file.

  • Nick, thanks for the response. I can ask the client how they feel about making the whole site secure. I will also have to check to make sure everything works correctly on the front end. That being said, is there anything you can see that would be causing this redirect issue? I updated my initial question to show the part that doesn't work. Thanks for any info. Oct 16, 2013 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.