Once a certificate is installed (via AutoSSL or manual upload), cPanel offers a built-in way to force HTTPS without editing .htaccess by hand.
Using the Domains interface
In cPanel's Domains section, each listed domain has a "Force HTTPS Redirect" toggle. Enabling it adds the necessary redirect rule automatically — a simpler alternative to writing your own .htaccess rewrite rules, and less likely to conflict with rules an application (like WordPress) also tries to manage.
If the toggle isn't available
This feature depends on the hosting provider's cPanel configuration — some shared hosts disable it. In that case, fall back to a manual .htaccess redirect (see our Apache/Nginx redirect guide), added above any application-specific rewrite rules.
Why the Force HTTPS Redirect toggle is preferred over manual .htaccess editing
cPanel's built-in toggle writes a clean, correctly ordered redirect rule automatically and is less likely to conflict with rules an application like WordPress separately manages — hand-written .htaccess rules risk being placed in the wrong position relative to application-generated rules, a common source of redirect loops covered in our troubleshooting guide on that topic.
What to do if the toggle isn't available on your specific hosting plan
Some shared hosting providers disable this specific cPanel feature at the account or reseller level — if it's missing, a manual .htaccess redirect (covered in our Apache and Nginx guides) remains a reliable fallback that doesn't depend on this particular cPanel feature being enabled.
What to check if AutoSSL and the Force HTTPS toggle seem to conflict
If a redirect loop appears after enabling both AutoSSL and the Force HTTPS Redirect toggle, confirm AutoSSL has actually finished issuing a valid certificate before the redirect was enabled — a redirect forcing HTTPS before a working certificate exists produces exactly this kind of loop.
How AutoSSL's automatic renewal interacts with the Force HTTPS setting long-term
Once both AutoSSL and the Force HTTPS Redirect toggle are correctly enabled, the two work together indefinitely without further intervention — AutoSSL handles certificate renewal transparently in the background, and the redirect setting remains in effect independent of any individual renewal event.
What to do if a specific subdomain isn't covered by the Force HTTPS toggle
The toggle applies per domain listed in cPanel's Domains section — a subdomain not showing its own toggle may need to be added as its own listed domain first, or may already be covered under a wildcard certificate if one is configured, worth checking the specific subdomain's own certificate status directly.
Why cPanel's redirect implementation is generally safe to leave permanently enabled
Because cPanel's toggle specifically checks for an already-working certificate before offering the redirect option, it's considerably less likely to produce the kind of premature-redirect issue a manually written rule might cause if enabled before a certificate was actually ready.
Why this remains one of the more reliable, well-tested redirect implementations available
Because cPanel's Force HTTPS Redirect feature is used across an enormous number of hosting accounts industry-wide, it's a genuinely well-tested implementation less likely to contain edge-case bugs than a hand-written custom rule — a reasonable default to prefer over manual .htaccess editing whenever it's available on your specific hosting plan.
What a hosting support ticket should specifically mention if this toggle isn't working
When contacting hosting support about a missing Force HTTPS toggle, specifically mentioning your cPanel version and asking whether the feature is disabled at the account or reseller level gets a faster, more targeted response than a general description of the missing feature.
How cPanel's interface has evolved across recent versions regarding this feature
The Force HTTPS Redirect toggle has been a stable, consistently available feature across recent cPanel versions, with only minor interface refinements over time — it's not a recently added feature likely to explain version-specific unavailability on a reasonably current hosting account.