Once your certificate is in place you will want every visitor to arrive on the secure version of the site. There are two parts to this: redirecting the request, and making sure the site itself uses https internally.
The redirect
The simplest method is the Force HTTPS Redirect toggle in cPanel, under Domains. Turn it on for the domain and cPanel handles the rest. Use this in preference to writing your own rules.
If you need to do it by hand, add this at the very top of the .htaccess file in your public_html:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
Two things to watch
- Do not add a redirect before the certificate exists. You will send visitors to an address with no certificate, and they will see a security warning instead of your site.
- Exclude the validation path. If you write your own rule, make sure it does not catch /.well-known/, or you will break the automatic certificate renewal described in Why my SSL certificate did not renew.
Then update the site itself
Change the site address in your content system or shop settings to the https version, so that internally generated links and canonical tags use it too. In CubeCart this is the store URL setting; in WordPress it is the Site Address and WordPress Address. Missing this step is the usual cause of a redirect loop.
