Redirecting Secure (HTTPS) Pages to Non Secure (HTTP) in Magento

Whilst Magento offers easy configuration for secure (SSL) pages to be enabled at the front end and back end of your store, it hasn’t catered for the redirection of https versions of your pages to the http versions where necessary (any pages that do not contain personal or sensitive information do not need to be served at secure pages).

As such, this can prove a hindrance when search engines rank your store and can subsequently result in multiple versions of your pages, either on http or https protocols being indexed in the search results. This can hold a multitude of negative knock on effects to the performance of your website in organic search (SEO).

This can be rectified by extending the function _checkShouldBeSecure.

Never directly modify the Magento core, always copy the files you wish to modify and extend to the local pool:-

Navigate to the below path:-

app/code/core/Mage/Core/Controller/Varien/Router/Standard.php

Copying Standard.php to the below path:-

app/code/local/Mage/Core/Controller/Varien/Router/Standard.php

You’re now safe to modify and extend in this file without your changes being overwritten when you upgrade Magento.

In your local copy of Standard.php, find the function _checkShouldBeSecure (around line 427 in Magento 1.7.X)…

    protected function _checkShouldBeSecure($request, $path = '')
    {
        if (!Mage::isInstalled() || $request->getPost()) {
            return;
        }

        if ($this->_shouldBeSecure($path) && !$request->isSecure()) {
            $url = $this->_getCurrentSecureUrl($request);
            if ($request->getRouteName() != 'adminhtml' && Mage::app()->getUseSessionInUrl()) {
                $url = Mage::getSingleton('core/url')->getRedirectUrl($url);
            }

            Mage::app()->getFrontController()->getResponse()
                ->setRedirect($url)
                ->sendResponse();
            exit;
        }
    }

Replace this function with this modified version:-

    protected function _checkShouldBeSecure($request, $path='')
	{
		if (!Mage::isInstalled() || $request->getPost()) {
			return;
		}

		if ($this->_shouldBeSecure($path) && !Mage::app()->getStore()->isCurrentlySecure()) {
			$url = $this->_getCurrentSecureUrl($request);

			Mage::app()->getFrontController()->getResponse()
				->setRedirect($url)
				->sendResponse();
			exit;
		} elseif (!$this->_shouldBeSecure($path) && Mage::app()->getStore()->isCurrentlySecure()) {
			$url = $this->_getCurrentUnsecureUrl($request);

			Mage::app()->getFrontController()->getResponse()
				->setRedirect($url)
				->sendResponse();
			exit;
		}
	}

And then add the function _getCurrentUnsecureUrl into Standard.php:-

	protected function _getCurrentUnsecureUrl($request)
	{
		if ($alias = $request->getAlias(Mage_Core_Model_Url_Rewrite::REWRITE_REQUEST_PATH_ALIAS)) {
			return Mage::getBaseUrl('link', false).ltrim($alias, '/');
		}

		return Mage::getBaseUrl('link', false).ltrim($request->getPathInfo(), '/');
	}

Then that’s it, clear your Magento cache and test by visiting the homepage, category or product URL by including https in the URL and check it redirects to the http version.