Where manual control is needed.
THE BASIC HTTPS REDIRECT
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]FORCING NON-WWW AS WELL
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [L,R=301]Combine carefully. Two separate redirects mean a visitor on http://www is redirected twice, which is slower and untidy. A single rule handling both is better.
EXCLUDING THE VALIDATION PATH
Above your redirect rules, add:
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/Otherwise AutoSSL renewal fails.
PLACEMENT
Redirect rules go above the application's own block. In WordPress, above the "# BEGIN WordPress" marker, or WordPress will overwrite them when permalinks are saved.
TESTING
Use a redirect checking tool that shows the full chain. You want one 301 hop from any starting form to the canonical https URL.
BACK UP FIRST
A bad .htaccess takes the whole site offline with a 500 error.
