.htaccess, HTTPS and www for Laravel

The rules

These go in public_html/.htaccess. Put the redirects before Laravel's own rule.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS
    RewriteCond %{HTTPS} !=on
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Pass the Authorization header to PHP (API tokens)
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Send everything that is not a real file to Laravel
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

The config generator adds the www rule for your domain, and the .htaccess generator writes redirects for old URLs.

Don't overwrite cPanel's lines

cPanel can add a block that sets your PHP version, marked php -- BEGIN cPanel-generated handler. If you replace the whole file, the site can fall back to another PHP version and show a 500 error or Composer version error. Edit the file and add to it, rather than uploading a new one over it.

After turning on HTTPS

• Set APP_URL to the https:// address, then clear the config cache.
• Set SESSION_SECURE_COOKIE=true.
• Check for pages without styles: the browser blocks http:// files on an https:// page.

If you use Cloudflare or a proxy, Laravel also needs to trust it, or it builds http:// links. In bootstrap/app.php, use $middleware->trustProxies(at: '*'); when the site can only be reached through the proxy.