Force HTTPS redirection with the web.config file on Plesk

Procédure

This help explains how to redirect visitors from the HTTP version of your site to its secure HTTPS version by adding a rule in the web.config file.

This method is intended for sites hosted on a Windows server with IIS. It can be used in particular when your application requires a custom redirection rule.

Before you begin

Check that your SSL/TLS certificate is installed and that your site displays correctly when you enter its address directly with https://.

The certificate must cover the address used by your visitors, including the domain with or without www.

Also download a copy of your web.config file before modifying it. This will allow you to restore it quickly if the site no longer displays after the change.

Accessing the web.config file

From your Plesk panel:

1. Open the Websites & Domains section.
   
2. Click File Manager.
3. Open the root folder of the site concerned. This is generally the httpdocs folder.
   
4. Look for the web.config file.
5. Download a copy of this file before modifying it.
   
6. Click the file, then open it in the text editor.

If no web.config file exists in the site's root folder, you can create one.

Add the HTTPS redirection rule

The change to make depends on the current content of your web.config file.

The web.config file is empty or does not exist

Add the following content:

Then save the file.

The file already contains a rewrite section

Do not create a second or section.

Only add the following rule inside the existing section, before the closing tag:

The rule name must be different from the other rules already present in the file.

Verify that the redirection works

Open a private browsing window, then enter your site address starting with http://.

For example:

http://yourdomain.com

The browser should automatically display:

https://yourdomain.com

Also test an internal page:

http://yourdomain.com/contact

It should be redirected to the same page over HTTPS:

https://yourdomain.com/contact

Also test the version with www if your site uses it.

Undo the change

If your site no longer displays after saving:

1. Go back to the Plesk File Manager.
2. Replace the modified web.config file with the copy downloaded before making the change.
   
3. Reload your site.

If you only added the rule in an existing section, delete the block starting with:

and ending with:

Then save the file and test your site again.

Common issues

My site shows a 500 error

The web.config file probably contains a syntax error or a duplicate section.

Restore the saved copy, then check:

• that every opening tag has a closing tag;
• that there is only one section;
• that there is only one section;
• that you have not added a second or section.

The browser shows a redirection loop

Another HTTPS redirection is probably already active.

Check:

• the other rules present in the web.config file;
• the HTTPS settings of your CMS or application;
• any redirects configured from Plesk.

Keep only one redirection method whenever possible.

Then test the site in a private browsing window so that an old redirect cached by the browser does not distort the result.

The site remains accessible over HTTP

Check that the web.config file is in the root folder of the correct site. This is generally the httpdocs folder, but a secondary domain may use another folder.

Also make sure the rule is placed in the section and that the file has been saved.

A security warning appears after the redirection

The redirection works, but the SSL/TLS certificate is not valid for the requested address.

Check that the certificate:

• is not expired;
• covers the domain name used;
• covers the version with www if it is used;
• covers the relevant subdomain.

The padlock does not appear even though the site is in HTTPS

Some site resources, such as images, scripts, or style sheets, are probably still loaded with an address starting with http://.

The redirection does not automatically change the links stored in your site. You must correct these addresses in your CMS, your database, or your application files.