网站HTTPS全站强制跳转配置教程

本文介绍如何在Nginx和Apache环境下配置HTTPS全站强制跳转，确保网站所有流量都通过加密通道访问。

为什么需要强制HTTPS

Nginx配置

基本跳转配置

在 server 配置中添加：

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/ssl/certs/example.crt;
    ssl_certificate_key /etc/ssl/private/example.key;

    # 强制HTTPS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    root /var/www/html;
    index index.php index.html;
}

只跳转首页

server {
    listen 80;
    server_name example.com;

    location = / {
        return 301 https://$server_name$request_uri;
    }

    location / {
        proxy_pass http://127.0.0.1:8080;
    }
}

Apache配置

启用重写模块

sudo a2enmod rewrite
sudo systemctl restart apache2

.htaccess配置

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

httpd.conf配置

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/html

    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteRule ^/?(.*)$ https://%{SERVER_NAME}/$1 [R=301,L]
</VirtualHost>

HSTS配置

HTTP Strict Transport Security强制浏览器使用HTTPS：

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Cloudflare强制HTTPS

在Cloudflare控制台设置：

1. SSL/TLS → 加密模式：完全灵活或完全严格
2. 页面规则：
3. URL：http://*example.com/*
4. 设置：始终使用HTTPS
5. 转发规则：301永久重定向

验证配置

测试命令

curl -I http://example.com

curl -I https://example.com

curl -I https://example.com | grep Strict-Transport

Google浏览器验证

1. 打开开发者工具（F12）
2. Network标签
3. 访问 http://example.com
4. 查看Status是否为301，Location是否为https://

常见问题

完整Nginx配置示例

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/ssl/certs/example.crt;
    ssl_certificate_key /etc/ssl/private/example.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

    root /var/www/html;
    index index.php index.html;

    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
}

配置完成后，网站所有HTTP请求都将自动跳转到HTTPS安全连接。