Joomla! Documentation™

Wat is SSL/TLS?

Transport Layer Security (TLS) is the successor to Secure Sockets Layer (SSL) - although many people still refer to it as SSL. Have you ever noticed the lock icon next to the URL when browsing the internet? That means that all the data you send to that website is being sent encrypted so anyone who may have hacked your network (or similar) and can intercept your requests is unable to view any of the data - they can only see what URLs you are accessing.

Why Use TLS?

Google (and most other search engines) now treat sites using https with preference. Furthermore many browsers flag any website with a form (such as a login or contact form) that isn't using https

How Do I Setup TLS?

To set up the certificate, the simplest way is to get your host to do it for you.

The correct certificate to use depends on the security protections required on your website. The least expensive and easiest option is to use Let's Encrypt - it's free and, depending on your host, can be often be configured straight from your cPanel or Plesk hosting dashboard.

If you've purchased a Dedicated IP and SSL certificate, ask your host to help and they will get it signed and install it in the correct location for you.

How Do I Redirect All Traffic to https

In Joomla

The easiest way to enforce https traffic is to do it within Joomla. In the Global Configuration there is a Force HTTPS option that allows you to force HTTPS either in the Administrator only or for the entire site. Prefer the latter.

In .htaccess

RewriteEngine on
RewriteCond %{SERVER_PORT} !^443$
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [QSA,R=301,L]
<IfModule !mod_ssl.c>
Redirect permanent / https://www.yourdomainname.com
</IfModule>

More Complex .htaccess Examples

To switch from HTTP to HTTPS on any page that has 'abc/def' or 'ghi' in the URL, add something like this:

Code:

RewriteCond %{HTTPS} off
RewriteRule ^(abc/def|ghi)(.*)/?$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

...and to switch from HTTPS back to HTTP on any page that has 'home' or 'help' in the URL, do something like this:

Code:

RewriteCond %{HTTPS} on
RewriteRule ^(home|help)(.*)/?$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

If you want to force SSL on a specific folder, insert the code below into an .htaccess file placed in that specific folder:

Code:

RewriteEngine On
RewriteCond %{REQUEST_URI} folder
RewriteRule ^(.*)$ https://www.example.com/folder/$1 [R,L]

Make sure you change the folder reference to the actual folder name. Then be sure to replace www.example.com/folder with your actual domain name and folder you want to force the SSL on.