Redirect Fixes in Plesk and cPanel

How a panel-hosted site is layered

On a typical Plesk server, a request passes through several pieces of software before your page is built, and each can send a redirect:

1. nginx at the front. Plesk normally runs nginx as the public-facing server. Anything in the domain's Additional nginx directives box runs here, before Apache sees the request.
2. Apache behind it. When the domain's proxy mode is on, nginx passes dynamic requests to Apache. Apache reads its own configuration, anything in the Additional Apache directives boxes, and then .htaccess files.
3. PHP and the application. WordPress, a shop or a framework then decides whether the URL it was given is its preferred form, and may redirect again.

Panel settings such as the preferred domain and the HTTPS redirect are written by Plesk into the web server configuration it generates for the domain, so they sit in the first two layers even though you set them on a hosting settings screen.

cPanel servers are usually simpler: Apache is the main web server, sometimes with nginx added as a caching proxy, and most redirect features in the cPanel interface work by writing rules into the domain's .htaccess file. That makes cPanel redirects easy to inspect, and also easy to duplicate by accident when someone later pastes their own rules into the same file.

Where Plesk keeps redirect settings

Menu names vary between Plesk versions and themes, so treat these as landmarks rather than exact paths. All of them are reached from the domain in Websites & Domains.

Edit rules only through these boxes, not in the generated configuration files on disk. Plesk rebuilds those files when settings change or the server is updated, and hand edits there are lost without warning.

# Additional nginx directives: page moves only.
# Host and HTTPS are left to the panel settings.
location = /opening-times.html { return 301 /visit-us/; }
location ^~ /old-shop/ { rewrite ^/old-shop/(.*)$ /shop/$1 permanent; }

Where cPanel keeps redirect settings

cPanel groups most of this under its Domains section. Again, labels differ a little between versions and hosting companies, who can hide or rename features.

• Force HTTPS Redirect. A per-domain switch on the Domains screen. It only becomes available once a valid certificate covers the domain.
• Redirects. A form that creates a redirect from a domain or path to another address. You choose permanent (301) or temporary (302), how www should be handled, and whether it is a wild card redirect that carries the rest of the path over to the destination.
• Addon and parked (alias) domains. Extra names for the account. An alias serves the same files as the main domain unless you add a redirect for it.
• File Manager. Where you can see the .htaccess file the Redirects form wrote to. Turn on the option to show hidden files, because names starting with a dot are hidden by default.

Because the Redirects form writes RewriteRule lines into .htaccess, it can conflict with rules already in that file, such as a WordPress block or a hand-written HTTPS rule. The form also sometimes produces patterns more permissive than you intended, such as a wild card redirect on the root that sends every page to the new site's homepage. Open the file after each change and read what was added.

# typical lines left by a panel redirect form
RewriteCond %{HTTP_HOST} ^example\.co\.uk$ [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.co\.uk$
RewriteRule ^old-menu$ "https\:\/\/www\.example\.co\.uk\/menu\/" [R=301,L]

Those escaped slashes and dots are valid and harmless, just hard to read. You can tidy them by hand once you are sure the rule is right.

Finding which layer sent the redirect

The Redirect Checker shows every hop and its status code. To tie each hop to a setting, compare it with the logs and headers.

• Look at the target. A hop that only changes http to https is an HTTPS rule; one that only adds or removes www is a host rule; one that changes the path is a page redirect. That narrows the search to one kind of setting.
• Check the logs. Plesk keeps separate logs for nginx and Apache, visible from the domain's Logs page; the files whose names include proxy belong to nginx. If a 301 appears in the nginx log but the request never appears in the Apache log, nginx answered it, so the rule is a panel setting or in the nginx box.
• Switch off one at a time. On a quiet period, untick one panel option and re-test in a private window. If the hop disappears, you have found its owner.
• Check the application last. WordPress redirects to the address stored in its site settings. If panel settings say non-www but WordPress is set to www, the two will fight, producing either a chain or a loop.

curl -sI http://example.co.uk/opening-times.html | grep -iE "^(HTTP|location|server|x-)"
curl -sI https://example.co.uk/opening-times.html | grep -iE "^(HTTP|location|server|x-)"

Common clashes and what they look like

The fix, step by step

Panels and WordPress together

Many panel-hosted sites are WordPress, and WordPress adds its own layer. It stores the site address and WordPress address in its settings and redirects any request for a different host to the stored one. Redirect plugins and SEO plugins can add more. A few rules keep the two worlds apart:

• Let the panel or CDN own https and www. Set WordPress's two addresses to exactly the same form, so its own redirect never fires in normal use.
• Let one plugin own page redirects, and do not also add them to .htaccess or the nginx box.
• Leave the # BEGIN WordPress block in .htaccess alone and put any hand-written rules above it. WordPress may rewrite the lines between its markers when permalinks are saved.
• If you use a Plesk WordPress management tool or a cPanel installer, check whether it offers its own https or www option, and make sure it agrees with the panel.

Keeping it tidy

• Record in one place which layer owns host, HTTPS and page redirects for each site on the server.
• When adding a new domain or alias, set its redirect behaviour at the same time as its certificate.
• After panel or server upgrades, re-run the Redirect Checker; generated configuration may change.
• Review the directive boxes whenever the site is rebuilt, because they are rarely looked at and outlive the pages they mention.