Migrate from HTTP to HTTPS

Redirection

After configuring your server with an SSL certificate, you may need to force HTTPS if your hosting provider doesn't offer automatic redirection.

Use only one of the following methods to enforce HTTPS:

Redirection from the server config file

Apache

Add this code to the /public/.htaccess file:

# Redirect all normal pages to https pages (http => https)
RewriteCond %{HTTPS} ^off$ [NC]
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1  [R=301,L]

Nginx

Configure Nginx to force SSL using this configuration snippet:

server {
    listen       443 ssl;
    server_name  domain.com;
    return       301 https://domain.tld$request_uri;
}

Redirection from the app's file

Uncomment line 38 in /app/Http/Middleware/HttpsProtocol.php:

// Production is not currently secure
return redirect()->secure($request->getRequestUri());

Update the /.env file

Activate HTTPS support by updating these variables in /.env:

APP_URL=https://domain.tld
FORCE_HTTPS=true

Important

Use the correct website URL/domain, which may include or exclude www (e.g., https://domain.tld or https://www.domain.tld).