text: If you really want to be sure that your server is only serving documents over an encrypted SSL channel (you wouldn't want visitors to submit a htaccess password prompt on an unencrypted connection) then you need to use the SSLRequireSSL directive with the +StrictRequire Option turned on.