Guide CyberPanel Rewrite Rules: Force HTTPS (301, Not 302) and Add an HSTS Header

**JAY** · (This post was last modified: 10-28-2026, 04:59 AM by JAY.)

CyberPanel Rewrite Rules: Force HTTPS (301, Not 302) and Add an HSTS Header

OpenLiteSpeed reads rewrite rules from

Code:

.htaccess

like Apache, and CyberPanel has an editor with ready-made templates. We used it on our test site cyber.adminslab.com (WordPress with LiteSpeed Cache) and found two things you should know: the built-in HTTPS template uses a temporary redirect, and Apache-style

Code:

Header

lines in .htaccess do nothing.

Where to edit rewrite rules
In Websites, open your site and click Full Settings. On the Config tab, open Rewrite Rules and pick a template. Force HTTP -> HTTPS adds these lines on top of your existing rules:

Code:

RewriteEngine On
RewriteCond %{HTTPS}  !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

The other templates: Force WWW -> NON-WWW, Force NON-WWW -> WWW and Disable Wordpress XMLRPC & Trackback. The editor shows the whole

Code:

.htaccess

of the site (ours already had the LiteSpeed Cache block), so you can also type your own rules there. Click Save Rewrite Rules; the change worked immediately on our server.

The 302 problem
Before saving, plain http gave

Code:

200 OK

(the site was reachable on both http and https). After saving the template:

Code:

curl -sI http://cyber.adminslab.com/test?x=1 | head -1
HTTP/1.1 302 Found

Code:

[R,L]

without a code means 302 Found, a temporary redirect. Search engines keep the http address indexed with a 302. For a permanent move you want 301. Change the flag to

Code:

[R=301,L]

in the editor (or with SSH) and save:

Code:

sed -i 's/\[R,L\]/[R=301,L]/' /home/yourdomain.com/public_html/.htaccess
systemctl restart lsws

After changing the flag to 301, http requests are redirected permanently, keeping the path and query string:

Code:

HTTP/1.1 301 Moved Permanently
location: https://cyber.adminslab.com/test?x=1

Force non-www (or www) with a 301
Use one canonical address. To send www to non-www permanently:

Code:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^/?(.*) https://%1/$1 [R=301,L]

Make sure the www name has DNS and is covered by the SSL certificate, or the redirect fails with a certificate error first. See the SSL guide.

HSTS: why .htaccess doesn't work
On Apache you'd add

Code:

Header always set Strict-Transport-Security "max-age=..."

to .htaccess. We tried exactly that, restarted OpenLiteSpeed, and checked both a cached page and

Code:

wp-login.php

: no HSTS header. OpenLiteSpeed uses .htaccess for rewrite rules, not for headers.

The working way is the virtual host config.
On the same Config tab, open vHost Conf and add a context with the header at the end:
[Image: attachment.php?aid=486]

Code:

context / {
  location                $DOC_ROOT/
  allowBrowse             1
  extraHeaders            <<<END_extraHeaders
Strict-Transport-Security: max-age=300
END_extraHeaders
}

Save, and every page now sends the header:

Code:

curl -sI https://cyber.adminslab.com/ | grep -i strict-transport
strict-transport-security: max-age=300

We checked afterwards that the http-to-https 301 and LiteSpeed Cache (

Code:

x-litespeed-cache: hit

) still worked with the new context.

Start small. We used

Code:

max-age=300

(5 minutes) to test. Browsers remember HSTS for the whole max-age, so if HTTPS ever breaks, visitors can't bypass it. When everything has worked for a while, raise it to a year:

Code:

max-age=31536000

. Only add

Code:

includeSubDomains

when every subdomain has a valid certificate.

Common problems

Too many redirects: Cloudflare in "Flexible" SSL mode sends http to your server, which redirects to https forever. Use Full (strict).
Rule seems ignored: restart OpenLiteSpeed after editing .htaccess over SSH:
Code:
systemctl restart lsws
.
Site broken after saving the vHost Conf: a typo in the config. Restore your copy (
Code:
cp /root/vhost.bak /usr/local/lsws/conf/vhosts/yourdomain.com/vhost.conf
) and restart lsws. Always back up the file first.
WordPress rules: keep your own rules above the
Code:
# BEGIN LSCACHE
/
Code:
# BEGIN WordPress
blocks and don't edit inside them; plugins rewrite those blocks.

More CyberPanel guides

Tested on CyberPanel 3.0 (build 8, OpenLiteSpeed edition) on Ubuntu 24.04, October 2026. Menu names can change slightly between versions.

Possibly Related Threads…matched by title
Guide Switch CyberPanel to LiteSpeed Enterprise: Free Trial, Results and What Breaks JAY	Replies:0Views:7	23 minutes agoJAY
Guide How to Change a Website's Domain in CyberPanel (Files, WordPress, 301) JAY	Replies:0Views:13	1 hour agoJAY
Guide CyberPanel Website Logs: Why PHP Errors Are Missing and How to See Them (Tested) JAY	Replies:0Views:16	8 hours agoJAY
Guide CyberPanel LiteSpeed and PHP Tuning: What Each Setting Does (and a Bug) JAY	Replies:0Views:13	Today, 07:05 AMJAY
Guide CyberPanel Behind Cloudflare: Real Visitor IPs and the Setting That Allows Fake IPs JAY	Replies:0Views:103	10-26-2026, 06:48 PMJAY

Guide CyberPanel Rewrite Rules: Force HTTPS (301, Not 302) and Add an HSTS Header

Attached Files