title: Force https for entire server/domain
body: <p>I am developing a number of forms which should only be accessed via https. I have a dedicated server with its own cert and all the good stuff.</p>
  
  <p>So my question is two-fold really:</p>
  
  <p>1). What's the best way to force every request to be https? Is there a better way than this .htacess/mod_rewrite rule:</p>
  
  <pre><code>RewriteCond %{HTTPS} off
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
  </code></pre>
  
  <p>2). Are there any potential pitfalls or downside to forcing everything to be https that I should be thinking about (other than overhead, which wouldn't seem to be an issue anyway)?</p>