Tag ~ Joomla Security

Force site to HTTPS in Joomla, first you must check the correct environment variable %{HTTPS} off, but your rule above then prepends the www. Since you have a second rule to enforce www., don't use it in the first rule.