How to Get the Current Full URL in PHP

To inspect or build the URL for the current PHP request, combine the request’s scheme, host, and URI. This is useful when rendering a page based on query parameters or recording the requested address. A constructed URL is only data: using it in a redirect still requires a separate decision about which destinations are allowed.

Build the current URL from request data

PHP does not provide a single $_SERVER value that is always the complete current URL. The server exposes pieces of request information, and your application combines the pieces it needs. For a typical web request, the scheme is http or https, the host may include a port, and the request URI contains the path and query string.

Read the scheme, host, and request URI from $_SERVER

$_SERVER is a superglobal array populated by the web server and runtime. $_SERVER['HTTP_HOST'] supplies the requested host, while $_SERVER['REQUEST_URI'] usually supplies the path and query string. Neither value alone is a full URL. The host is derived from the incoming request, so treat it as untrusted input: validate it against known hosts before using it in security-sensitive output, such as a redirect or an absolute link in an email.

Handle HTTPS and proxy-aware requests

When PHP receives the request directly over TLS, $_SERVER['HTTPS'] is commonly set to a non-empty value such as on. Check that value before choosing the scheme; do not assume every server sets it identically. $_SERVER['REQUEST_SCHEME'] may also be available, but its availability and meaning depend on the server configuration.

In a reverse-proxy deployment, the browser may connect over HTTPS while the proxy connects to PHP over HTTP. In that arrangement, the direct HTTPS value can describe only the proxy-to-PHP connection. A forwarded scheme header can help only when the application is behind a specifically configured, trusted proxy that removes or replaces client-supplied copies. Do not trust forwarded headers from arbitrary requests. Configure that trust at the proxy and application layers, or use the scheme the server reliably provides.

Include the path and query string

$_SERVER['REQUEST_URI'] commonly contains a value such as /products.php?category=books&page=2; appending it preserves both the path and query string. It does not include the scheme or host. The query string can contain private or sensitive values, so consider whether it belongs in logs, page output, or an emailed URL. Avoid treating a request URI as a canonical URL without accounting for your application’s routing and deployment configuration.

Choose a method and verify the result

For a normal request handled directly by the web server, combine the server values explicitly. This self-contained example uses representative request values so the assembly is clear. It has not been executed in this writing stage:

<?php
$_SERVER = [
    'HTTPS' => 'on',
    'HTTP_HOST' => 'shop.example.test',
    'REQUEST_URI' => '/products.php?category=books&page=2',
];

$isHttps = isset($_SERVER['HTTPS'])
    && $_SERVER['HTTPS'] !== ''
    && strtolower((string) $_SERVER['HTTPS']) !== 'off';
$scheme = $isHttps ? 'https' : 'http';
$host = $_SERVER['HTTP_HOST'];
$requestUri = $_SERVER['REQUEST_URI'];
$currentUrl = $scheme . '://' . $host . $requestUri;

echo $currentUrl, PHP_EOL;

The resulting string is assembled from the scheme, host, and request URI. In your application, use the actual request-provided values and confirm how your web server and any trusted proxy populate them. Validate the host before using the result in a redirect; constructing the current URL does not make an arbitrary redirect destination safe.