This is my first time using ssl. This is for a site that will be used to collect sensitive personal medical data. I'd like to be clear about the process before I wade into details of coding.

Using Linux server I've copied site folders into folder called secure where the ssl certificate is. What I'd like to do is take down the contents of the public folder so no one can access the data from there.

The tech at the web host told me two things about this that I'm not clear about. The techs there have been spot on.

1. That I couldn't use .htaccess with linux servers; that I should write a redirect (I'm guessing he meant html or php and that he is mistaken about .htaccess).

2. That I should put the redirect inside the secure folder. This would move folk coming to the http site to https automatically.

The webhost's knowledge base gives examples of redirects using php and html/javascript in addition to .htaccess.

Q's:

1. Is this overview correct?
2. Is this the best way to accomplish this?
3. Is what I want to do called forcing http to https?
4. Do I want to do this in php, html/javascript or some other way?

Thanks,

Scott