I have recently configured the farm to be accessed via HTTPS.

When clients connect to their content using HTTPS, all is fine.

When connecting to a site collection using HTTP, the client is redirected to the HTTPS, and this also is fine.

However, and this is the reason why I'm writing this question, when the client connects to a subsite using HTTP, the server does not redirect to HTTPS, and the client is allowed to browse content entirely via HTTP.

I think this is due to a misconfiguration in the system which someone more expert than me may explain and answer with a solution.

I'd like the system still performing HTTP redirection to HTTPS even when clients connect directly to subsites or pages.

Here follows the details of my configuration:

In SharePoint, web application list, I've SharePoint -80 with HTTPS url https://sps.mycompany.net. This web application originally had HTTP url http://sps.mycompany.net and was extended with the HTTPS.

In SharePoint the AAM is configured as follows:

Internal URL               Zone    Public URL for Zone 
http://sps                 Default https://sps.mycompany.net 
https://sps.mycompany.net  Default https://sps.mycompany.net 
http://sps.mycompany.net   Default https://sps.mycompany.net 

In IIS, I have the following web sites, SharePoint - 80 and the SharePoint - 443 both running. The server certificate has been assigned only to SharePoint - 443.

Please tell me if you need more detail.


1 Answer 1


You can disable the http binding in your IIS. Open the site and have a look on the right side under "Actions" you will find "Bindings". Allow only the 443 binding with a valid certificate for your site and remove the 80 port binding ;) If you do this then users will not be able to reach anything with http anymore for this site.

You can use the Rewrite module in IIS for directing them to https automatically:

When a site that requires SSL is accessed via non-secure HTTP connection, IIS responds with HTTP 403 (Unauthorized) status code. This may be fine if you always expect that your site visitors will be typing “https://…” in the browser’s address bar. But if you want your site to be easily discoverable and more user friendly, you probably would not want to return 403 response to visitors who came over unsecure HTTP connection. Instead you would want to redirect them to the secure equivalent of the URL they have requested. A typical example is this URL: http://www.paypal.com. If you follow it you will see that browser gets redirected to https://www.paypal.com.

With URL Rewrite Module you can perform this kind of redirection by using the following rule:

<rule name="Redirect to HTTPS" stopProcessing="true">
  <match url="(.*)" />
    <add input="{HTTPS}" pattern="^OFF$" />
  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="SeeOther" />
  • Thanks for your clear answer. Can you describe a bit of the rule? What are the risks of the this approach, if any. Mar 30, 2013 at 8:54
  • In my opinion there is no risk. Users that stored a http link will be forwarded automatically.
    – hupseb
    Mar 30, 2013 at 13:10
  • Try it on a test system if you have doubts.
    – hupseb
    Mar 30, 2013 at 13:11
  • Can you explain the disabling of port 80 in more detail? If I remove the binding for port 80 I get a 404, not a 403 and the url rewrite does not work.
    – MickB
    Jan 22, 2018 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.