Ttdfjt

In the backend, I've enabled Use Secure URLs in the Frontend. But users can still visit my site through non-secure URLs, except for checkout/account pages.

I want to force secure URLs on all pages. What I do right now is change the unsecure base URL to "https://...."

It seems working. If users use HTTP, they'll be redirected to https. But I wonder if this is the correct way to do it. Any side effects?

The default answer is, set the unsecure base url to https://
depending on your setup this already is enough for a redirect if users try to use http://

Maybe a redirect on webserver level is better, as it avoids requests going through php first.

And if you want the real perfectly secure solution, you should add your website on https://hstspreload.appspot.com/ .
But careful with this, if you need to change your certificate, this can cause big problems. Let your Hoster care about this Part.

you can do this with .htaccess in apache. Use these lines:

############################ Force SSL ############################
RewriteCond %HTTP_HOST !^localhost$
RewriteCond %HTTP:X-Forwarded-Proto =http
RewriteRule ^ https://%HTTP_HOST%REQUEST_URI [L,R=301]
############################ Force SSL ############################

I have tried the previous solutions and even though they seemed to work they locked me out of admin panel (don't completely understand the reason).

To get into the admin panel again I had to get into phpmyadmin and get into to database table core_config_data and change both paths: web/secure/use_in_adminhtml and web/unsecure/base_url get back into the admin panel again. And don't forget to clear out the cache folder if you have to make edits in the database...

So I applied the following .htaccess solution instead which let me login to admin as well

# AFTER THIS SECTION
############################################
## workaround for HTTP authorization
## in CGI environment
RewriteRule .* - [E=HTTP_AUTHORIZATION:%HTTP:Authorization]

# PUT THIS 
############# ALL PAGES HTTPS #################
RewriteCond %HTTPS off
RewriteCond %REQUEST_URI !/admin/
RewriteCond %REQUEST_URI !/downloader/
RewriteRule ^(.*)$ https://%HTTP_HOST%REQUEST_URI [L,R=301]
############# ALL PAGES HTTPS #################

Hope it helps someone

For anyone stumbling across this (like I did)

Don't use htaccess. Under admin go Stores -> General -> Web and change -> Use Secure URLs on Storefront -> Yes and Use Secure URLs in Admin -> Yes

There's no need to edit any files.

Most approaches on .htaccess would redirect most pages to home when accessed via http.

Example:
http://www.mystore.com/productA.html => http://www.mystore.com/

instead of https://www.mystore.com/productA.html

I solved it with the following .htaccess rewrite (Apache only, of course):

#Force SSL
RewriteCond %HTTPS off
RewriteRule (.*) https://%HTTP_HOST%REQUEST_URI [R=301,L]

See source.