<p>Is there a clean way to redirect all attempts to going to an HTTP:// version of a site to its HTTPS:// equivalent?</p>

[{'answer_id': 46418, 'author': 'slipsec', 'author_id': 1635, 'author_profile': 'https://Stackoverflow.com/users/1635', 'pm_score': -1, 'selected': False, 'text': '<p>I think by \'cleanly\' you mean like with a 300 redirect.  Config for a lot of servers &amp; languages <a href="http://www.somacon.com/p145.php" rel="nofollow noreferrer">here</a>.</p>\n'}, {'answer_id': 1207097, 'author': 'mika', 'author_id': 13460, 'author_profile': 'https://Stackoverflow.com/users/13460', 'pm_score': 3, 'selected': False, 'text': '<p>A clean way changes only the URL scheme from http -> https and leaves everything else equivalent. It should be server-side so that there are no browser issues.</p>\n\n<p>JPPinto.com has <a href="http://www.jppinto.com/index.php/2009/04/automatically-redirect-http-requests-to-https-iis-7/" rel="nofollow noreferrer">Step-By-Step instructions</a> on how this is done, except that they use javascript (HttpRedirect.htm) instead of a server-side redirect. For some reason, I couldn\'t get IE run the javascript if you have ‘Show friendly HTTP error messages’ enabled, which is on by default. Another thing with the script is that redirection to path didn\'t work even in FF or Chrome. The script always redirects to root. (Maybe I have missed something, because it should redirect to path.)</p>\n\n<p>For these reasons I have used an ASP page for the redirect. The downside is of course that this requires classic ASP to be enabled on the server.</p>\n\n<p>OpsanBlog has an <a href="http://blog.opsan.com/archive/2005/04/17/395.aspx" rel="nofollow noreferrer">ASP script and instructions</a> that work well with IIS6. </p>\n\n<p>I\'ve had a few issues using this method with IIS7. User interface issues mostly, since IIS7 makes it really easy to miss something.</p>\n\n<ul>\n<li>First, you need to install ASP as a\nweb server role feature.  </li>\n<li>Second, using a virtual directory didn\'t not\nwork as expected in IIS7 and I didn\'t\ntry to debug this. Instead, I put the file in the root folder of the site and used\nthe url \'/SSLRedirect.asp\' in the\n403.4 error page to reference it.</li>\n<li>Last, the most tricky part, you <strong>must NOT enforce SSL for SSLRedirect.asp</strong>. Otherwise you\'ll get an 403.4 error. To do this you pick the file in IIS7 \'Content View\', and switch to \'Features View\' so that you can edit the SSL settings for the single file and disable \'Require SSL\' checkbox. </li>\n</ul>\n\n<p>IIS manager should show the file name in the header. </p>\n'}, {'answer_id': 7605311, 'author': 'toxaq', 'author_id': 97429, 'author_profile': 'https://Stackoverflow.com/users/97429', 'pm_score': 8, 'selected': True, 'text': '<p>I think the cleanest way is as described <a href="http://www.iis-aid.com/articles/how_to_guides/redirect_http_to_https_iis_7" rel="nofollow noreferrer">here on IIS-aid.com</a>. It\'s web.config only and so if you change server you don\'t have to remember all the steps you went through with the 403.4 custom error page or other special permissions, it just works.</p>\n\n<pre><code>&lt;configuration&gt;\n  &lt;system.webServer&gt;\n    &lt;rewrite&gt;\n      &lt;rules&gt;\n        &lt;rule name="HTTP to HTTPS redirect" stopProcessing="true"&gt;\n          &lt;match url="(.*)" /&gt;\n            &lt;conditions&gt;\n              &lt;add input="{HTTPS}" pattern="off" ignoreCase="true" /&gt;\n            &lt;/conditions&gt;\n            &lt;action type="Redirect" redirectType="Permanent" url="https://{HTTP_HOST}/{R:1}" /&gt;\n        &lt;/rule&gt;\n      &lt;/rules&gt;\n    &lt;/rewrite&gt;\n  &lt;/system.webServer&gt;\n&lt;/configuration&gt;\n</code></pre>\n'}, {'answer_id': 38369227, 'author': 'ColacX', 'author_id': 700735, 'author_profile': 'https://Stackoverflow.com/users/700735', 'pm_score': 4, 'selected': False, 'text': '<p>The most easy and clean solution I found was to</p>\n\n<ol>\n<li><p>In SSL Settings -> require SSL</p></li>\n<li><p>In Error Pages -> On 403.4 error -> Redirect to the HTTPS site</p></li>\n<li><p>In Error Pages -> Edit Features Settings... -> Set Detailed errors for local requests and custom error pages for remote request</p></li>\n</ol>\n\n<p>The benefit is that it requires no extra lines of code.\nDownside is that it redirects you to an absolute url.</p>\n'}, {'answer_id': 44283235, 'author': 'Toolkit', 'author_id': 631527, 'author_profile': 'https://Stackoverflow.com/users/631527', 'pm_score': 0, 'selected': False, 'text': '<p>Global.asax</p>\n\n<pre><code>protected void Application_BeginRequest()\n{\nif (!Context.Request.Url.AbsoluteUri.Contains("localhost") &amp;&amp; !Context.Request.IsSecureConnection)\nResponse.Redirect(Context.Request.Url.ToString().Replace("http:", "https:"));\n}\n</code></pre>\n'}, {'answer_id': 53725455, 'author': 'Jean-Marc', 'author_id': 2729328, 'author_profile': 'https://Stackoverflow.com/users/2729328', 'pm_score': 0, 'selected': False, 'text': '<p>I use classic asp (intranet) and on pages that requires login the logon include file does the redirect: </p>\n\n<pre><code>if Request.ServerVariables("SERVER_PORT_SECURE") &lt;&gt; "1" or Request.ServerVariables("HTTPS") &lt;&gt; "on" then \n    Response.Redirect "https://" &amp; Request.ServerVariables("SERVER_NAME") &amp; Request.ServerVariables("URL")\nend if\n</code></pre>\n\n<p>This of course does not include GET or POST data. So in effect it\'s a clean redirect to your secured page. </p>\n'}]
['https://Stackoverflow.com/questions/46347', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/2312/']