How to Redirect HTTP to HTTPS in IIS

This tutorial will help you to configure your IIS to redirect any URL from HTTP to HTTPS. This is a good practice to keep production URLs always-on secure page. After completing this tutorial your all the non-secure (HTTP) requests to your websites will be redirected to secure (HTTPS) in IIS on Windows.

Before we start

We assume you already have installed an SSL certificate in IIS.


Also added the SSL binding to your websites with port 443 and installed certificate.

Step 1 – Install URL-Rewrite Module

We use the URL Rewrite module in IIS to perform HTTP to HTTPS redirection. First of all, you need to download and install the URL Rewrite Module in IIS from here:

https://www.iis.net/downloads/microsoft/url-rewrite

Step 2 – Configure HTTP to HTTPS Redirection

Once the installation finished, follow the below steps to complete HTTPS redirection in IIS.

• 1. Launch IIS Manager and select the website under the connections section on the left.
• 2. You will see all the configuration options in the middle window. Just double click on the URL Rewrite icon.

  

• 3. On the left side click on Add Rule then select Blank rule.

  

• 4. First, enter a user-friendly name like we used “Redirect-To-HTTPS”. Then, under the Match URL section, set Requested URL to “Matches the Pattern” and set Using to “Regular Expressions“. Then set the Pattern type to (.*) as shown in the below screenshot.

  

• 5. Now, expand the Conditions block. Under Logical Grouping change the drop-down to Match All and click on Add. Under the Condition input box type “{HTTPS}“. In the input string select “Matches the Pattern” and set the Pattern value to “^OFF$“.

  

• 6. After the above changes, expand the Action block. Select the Redirect option in the Action Type dropdown. Set the Redirect URL to “https://{HTTP_HOST}/{R:1}“. Append query string must be checked and set the Redirect type select Permanent (301). Then click the Apply button in the right sidebar.

  

Conclusion

All done, You have successfully configured your site to always redirect to secure https url. To verify open your URL in a browser without https and it should auto-redirect to https.