Always redirect to HTTPS

Hello @Kobject,

Seems like you added the HSTS header to your apache conf. This directive tells the browser visiting your site that for the max age configured in the directive, the browser should access your site always using https. So the “problem” is in your browser right now.

In your apache conf you should have/had something like this:

Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"

Well, you have removed all your conf, even letsencrypt certs (I hope you have backups), so at this point you have three options:

1.- Remove your browser’s cache and try again to access your http site.

2.- Use a new and fresh browser so this browser doesn’t know yet about your hsts header and you could visit your site using http.

3.- Recover all the apache and letsencrypt files that you removed, edit apache conf and change the header directive using max-age=0, something like this:
Header always set Strict-Transport-Security "max-age=0; includeSubdomains; preload"

Reload or restart apache and visit again your site, once visited the browser will ignore the htst header and you could access your site using only http.

Note: I don’t use Drupal so this issue could also be related to some redirect/rewrite performed in your drupal conf… that’s something that you should know.

Good luck.
sahsanu

1 Like