Guide CyberPanel Rewrite Rules: Force HTTPS (301, Not 302) and Add an HSTS Header

Guide CyberPanel Rewrite Rules: Force HTTPS (301, Not 302) and Add an HSTS Header - Printable Version

+- AdminsForum (https://adminsforum.com)
+-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels)
+--- Forum: CyberPanel (https://adminsforum.com/Forum-cyberpanel)
+---- Forum: CyberPanel Guides & Tutorials (https://adminsforum.com/Forum-cyberpanel-guides-tutorials)
+----- Forum: CyberPanel Websites & OpenLiteSpeed Guides (https://adminsforum.com/Forum-cyberpanel-websites-openlitespeed-guides)
+----- Thread: Guide CyberPanel Rewrite Rules: Force HTTPS (301, Not 302) and Add an HSTS Header (/Thread-guide-cyberpanel-rewrite-rules-force-https-301-not-302-and-add-an-hsts-header)

CyberPanel Rewrite Rules: Force HTTPS (301, Not 302) and Add an HSTS Header - JAY - 10-26-2026

CyberPanel Rewrite Rules: Force HTTPS (301, Not 302) and Add an HSTS Header

OpenLiteSpeed reads rewrite rules from

Code:

.htaccess

like Apache, and CyberPanel has an editor with ready-made templates. We used it on our test site cyber.adminslab.com (WordPress with LiteSpeed Cache) and found two things you should know: the built-in HTTPS template uses a temporary redirect, and Apache-style

Code:

Header

lines in .htaccess do nothing.

Where to edit rewrite rules
In Websites, open your site and click Full Settings. On the Config tab, open Rewrite Rules and pick a template. Force HTTP -> HTTPS adds these lines on top of your existing rules:

Code:

RewriteEngine On
RewriteCond %{HTTPS}  !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

The other templates: Force WWW -> NON-WWW, Force NON-WWW -> WWW and Disable Wordpress XMLRPC & Trackback. The editor shows the whole

Code:

.htaccess

of the site (ours already had the LiteSpeed Cache block), so you can also type your own rules there. Click Save Rewrite Rules; the change worked immediately on our server.

The 302 problem
Before saving, plain http gave

Code:

200 OK

(the site was reachable on both http and https). After saving the template:

Code:

curl -sI http://cyber.adminslab.com/test?x=1 | head -1
HTTP/1.1 302 Found

Code:

[R,L]

without a code means 302 Found, a temporary redirect. Search engines keep the http address indexed with a 302. For a permanent move you want 301. Change the flag to

Code:

[R=301,L]

in the editor (or with SSH) and save:

Code:

sed -i 's/\[R,L\]/[R=301,L]/' /home/yourdomain.com/public_html/.htaccess
systemctl restart lsws

After changing the flag to 301, http requests are redirected permanently, keeping the path and query string:

Code:

HTTP/1.1 301 Moved Permanently
location: https://cyber.adminslab.com/test?x=1

Force non-www (or www) with a 301
Use one canonical address. To send www to non-www permanently:

Code:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^/?(.*) https://%1/$1 [R=301,L]

Make sure the www name has DNS and is covered by the SSL certificate, or the redirect fails with a certificate error first. See the SSL guide.

HSTS: why .htaccess doesn't work
On Apache you'd add

Code:

Header always set Strict-Transport-Security "max-age=..."

to .htaccess. We tried exactly that, restarted OpenLiteSpeed, and checked both a cached page and

Code:

wp-login.php

: no HSTS header. OpenLiteSpeed uses .htaccess for rewrite rules, not for headers.

The working way is the virtual host config.
On the same Config tab, open vHost Conf and add a context with the header at the end:
[Image: attachment.php?aid=486]

Code:

context / {
  location                $DOC_ROOT/
  allowBrowse             1
  extraHeaders            <<<END_extraHeaders
Strict-Transport-Security: max-age=300
END_extraHeaders
}

Save, and every page now sends the header:

Code:

curl -sI https://cyber.adminslab.com/ | grep -i strict-transport
strict-transport-security: max-age=300

We checked afterwards that the http-to-https 301 and LiteSpeed Cache (

Code:

x-litespeed-cache: hit

) still worked with the new context.

Start small. We used

Code:

max-age=300

(5 minutes) to test. Browsers remember HSTS for the whole max-age, so if HTTPS ever breaks, visitors can't bypass it. When everything has worked for a while, raise it to a year:

Code:

max-age=31536000

. Only add

Code:

includeSubDomains

when every subdomain has a valid certificate.

Common problems

Too many redirects: Cloudflare in "Flexible" SSL mode sends http to your server, which redirects to https forever. Use Full (strict).
Rule seems ignored: restart OpenLiteSpeed after editing .htaccess over SSH:
Code:
systemctl restart lsws
.
Site broken after saving the vHost Conf: a typo in the config. Restore your copy (
Code:
cp /root/vhost.bak /usr/local/lsws/conf/vhosts/yourdomain.com/vhost.conf
) and restart lsws. Always back up the file first.
WordPress rules: keep your own rules above the
Code:
# BEGIN LSCACHE
/
Code:
# BEGIN WordPress
blocks and don't edit inside them; plugins rewrite those blocks.

More CyberPanel guides

Tested on CyberPanel 3.0 (build 8, OpenLiteSpeed edition) on Ubuntu 24.04, October 2026. Menu names can change slightly between versions.