# Web app only accessible via HTTPS

**URL:** <https://forum.elixirforum.com/t/web-app-only-accessible-via-https/49909>\
**Category:** Questions\
**Tags:** phoenix, deployment\
**Created:** [August 31, 2022, 1:57pm UTC](https://forum.elixirforum.com/t/web-app-only-accessible-via-https/49909 "2022-08-31T13:57:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cleemzy](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/cleemzy/32/22495_2.png) [@Cleemzy](https://forum.elixirforum.com/u/Cleemzy)\
**Post date:** [August 31, 2022, 1:57pm UTC](https://forum.elixirforum.com/t/web-app-only-accessible-via-https/49909/1 "2022-08-31T13:57:17Z")

</div>

Hello everyone,  
I have a web app in production and generated SSL certificates for it.  
The problem is, I can only access the domain with https, which means if I only type “[example.com](http://example.com)” in the url, it doesn’t redirect to the https version and the site can’t be reached.  
So if I want to access the website for the first time, I always have to manually type “https”. I notice that once accessed on that particular browser, I can finally type the domain name in the url normally without “https”.  
It just bothers me because customers shouldn’t have to bother doing those steps.  
I note that I have force\_ssl: [hsts: true] in my endpoint config.  
Thanks.

---

<div class="post-metadata">

**Author:** ![hassanRsiddiqi](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/hassanrsiddiqi/32/30975_2.png) [@hassanRsiddiqi](https://forum.elixirforum.com/u/hassanRsiddiqi)\
**Post date:** [August 31, 2022, 3:41pm UTC](https://forum.elixirforum.com/t/web-app-only-accessible-via-https/49909/2 "2022-08-31T15:41:17Z")

</div>

can you try in under `config :backend, BackendWeb.Endpoint,` to `force_ssl: [rewrite_on: [:x_forwarded_proto]]` in `prod.exs`

---

<div class="post-metadata">

**Author:** ![Cleemzy](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/cleemzy/32/22495_2.png) [@Cleemzy](https://forum.elixirforum.com/u/Cleemzy)\
**Post date:** [September 1, 2022, 7:30am UTC](https://forum.elixirforum.com/t/web-app-only-accessible-via-https/49909/3 "2022-09-01T07:30:19Z")

</div>

Thank you for your answer 👍 , I’m gonna try it right away and tell my customers to check their browsers for irregular behaviors.

---

<div class="post-metadata">

**Author:** ![derek-zhou](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/derek-zhou/32/19943_2.png) [@derek-zhou](https://forum.elixirforum.com/u/derek-zhou)\
**Post date:** [September 1, 2022, 1:35pm UTC](https://forum.elixirforum.com/t/web-app-only-accessible-via-https/49909/4 "2022-09-01T13:35:02Z")

</div>

The http → https rewrite usually happens in the reverse proxy (if you use one) or application hosting layer ([fly.io](http://fly.io) does it). If you run your app without a reverse proxy and on a bare VPS then you need to do it yourself, as @hassanRsiddiqi has mentioned.