Forcing SSL and WWW using .htaccess I would like to know if this code in .htaccess for forcing SSL and WWW in URL is correct, because with another code I usually get redirect loop, e.g. RewriteCond %{HTTPS} !=on and now it works like a charm (suspiciously). Also, is it possible to write it better/simpler?

# Force to SSL
RewriteCond %{HTTP:HTTPS} !1
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

# Force to WWW
RewriteCond %{HTTP_HOST} !^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L]
What you're doing with RewriteCond %{HTTP:HTTPS} !1 is checking whether the HTTPS header is present in the request and if it is, then the value is not 1.


  %{HTTP:header}, where header can be any HTTP MIME-header name,
  can always be used to obtain the value of a header sent in the HTTP
  request. Example: %{HTTP:Proxy-Connection} is the value of the HTTP
  header Proxy-Connection:.


Though, I think it'd be easier to use %{HTTPS} instead.


  %{HTTPS}
  
  Will contain the text "on" if the connection is using SSL/TLS, or
  "off" otherwise. (This variable can be safely used regardless of
  whether or not mod_ssl is loaded).


RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L,QSA]


Also, you are not using QSA flag. This might cause in undesired behaviour.