Force HTTPS redirection with the web.config file on Plesk

Procédure

This help explains how [PERSON_NAME] the HTTP version of your site to its secure HTTPS version by adding a rule in the web.config file.

This method is intended for sites hosted on a Windows server with IIS. It can notably be used when your application requires a custom redirection rule.

Before you begin

Check that your SSL/TLS certificate is installed and that your site displays correctly when you enter its address directly in https://.

The certificate must cover the address used by your visitors, in particular the domain with or without www.

Also download a copy of your web.config file before modifying it. This will allow you to restore it quickly if the site no longer displays after the change.

Accessing the web.config file

From your Plesk panel:

1. Open the Websites & Domains section.
   
2. Click File Manager.
3. Open the folder for the [ADDRESS] site concerned. This is usually the httpdocs folder.
   
4. Find the web.config file.
5. Download a copy of this file before modifying it.
   
6. Click the file, then open it in the text editor.

[PERSON_NAME] web.config does not exist in the [ADDRESS] site folder, you can create one.

[PERSON_NAME] HTTPS redirection

The modification to make depends on the current content of your web.config file.

The web.config file is empty or does not exist

Add the following content:

Then save the file.

The file already contains a rewrite section

Do not create a second or section.

Only add the following rule inside the existing section, before the closing tag:

The rule name must be different from that of the other rules already present in the file.

[PERSON_NAME] the redirection works

Open a private browsing window, then enter your site address starting with http://.

For example:

http://votredomaine.fr

The browser should automatically display:

https://votredomaine.fr

Also test an internal page:

http://votredomaine.fr/contact

[PERSON_NAME] in HTTPS:

https://votredomaine.fr/contact

[PERSON_NAME] also test the version [PERSON_NAME] www if it is used by your site.

[PERSON_NAME] the change

If your site no longer displays after saving:

1. Go back to Plesk File Manager.
2. Replace the modified web.config file with the copy downloaded before making the change.
   
3. Reload your site.

If you only added the rule in an existing section, [ADDRESS] starting with:

and ending with:

Then save the file and test your site again.

Common problems

My site displays a 500 error

The web.config file probably contains a syntax error or a duplicate section.

Restore the backup copy, then check:

• that each opening tag has a closing tag;
• that there is only one section;
• that there is only one section;
• that you did not add a second or section.

The browser displays a redirection loop

Another HTTPS redirection is probably already active.

Check:

• the other rules present in the web.config file;
• the HTTPS settings of your CMS or application;
• any redirections configured from Plesk.

Keep only one redirection method when possible.

[PERSON_NAME] then the site in a private browsing window so that an old redirect cached by the browser does not distort the result.

The site remains accessible over HTTP

Check that the web.config file is located in the root folder of the correct site. This is usually the httpdocs folder, but a secondary domain may use another folder.

Also check that is present and that the file has been saved.

A security warning appears after the redirect

The redirection works, but the SSL/TLS certificate is not valid for the requested address.

Check that the certificate:

• is not expired;
• covers the domain name used;
• covers the version with www if it is used;
• covers the relevant subdomain.

The padlock does not appear even though the site is in HTTPS

Some resources on the site, such as images, scripts, or stylesheets, are probably still being loaded with an address starting with http://.

The redirection does not automatically modify the links saved in your site. You must correct these addresses in your CMS, your database, or your application files.