How to set HTTPS-only header on .htaccess?

Question

I'm trying to set HTTPS-only header with .htaccess.

This works on MAMP Pro, but on the live server the header is missing on 301 redirect responses:

Header always set Strict-Transport-Security '...' env=HTTPS

The issue can be fixed with this:

Header always set Strict-Transport-Security '...' "expr=%{HTTPS} == 'on'"

But it doesn't work with MAMP: 500 Internal Server Error is returned.

Can I make expressions (like that "expr=%{HTTPS} == 'on'" ) work on MAMP? How?

Answer 1

In my experience, MAMP/MAMP Pro does not necessarily work with .htaccess. Mainly due to the fact that MAMP makes your machine a local server, so depending on your .htaccess some rules may be conflicting with MAMP's setup. Every time I run a local instance of one of my sites on MAMP I have to temporarily remove any and all .htaccess files.

In terms of getting your server to force ssl connections, I used these lines of code at the top of .htaccess below "Options -Indexes":

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]