Websites

Redirect to https and www in IIS with web.config

By Matt Chapman/Published 25 March 2016/Updated 2 November 2026/2 min read

If your websites run on IIS, .htaccess files don’t apply. Redirects go in the site’s web.config file instead, using the IIS URL Rewrite module.

The rule below sends every request for http://yourdomain.co.uk, https://yourdomain.co.uk or http://www.yourdomain.co.uk to https://www.yourdomain.co.uk with a permanent (301) redirect, keeping the rest of the address and any query string.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="Redirect to https www" stopProcessing="true">
          <match url="(.*)" />
          <conditions logicalGrouping="MatchAny">
            <add input="{HTTP_HOST}" pattern="^www\.yourdomain\.co\.uk$" negate="true" />
            <add input="{HTTPS}" pattern="off" />
          </conditions>
          <action type="Redirect" url="https://www.yourdomain.co.uk/{R:1}" redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

Before you use it

• Change yourdomain.co.uk to your own domain in both places.
• The URL Rewrite module must be installed on the server. Without it, IIS returns a 500 error for any web.config containing a <rewrite> section.
• If the site already has a web.config, don’t replace it. Copy just the <rewrite> section into the existing <system.webServer> section.
• The site needs a valid SSL certificate for the www name, bound to port 443, or visitors will see a certificate warning after the redirect.

Test it by visiting each version of the address in a private browser window. Every one should end up on https://www.yourdomain.co.uk/.