Description
Ensure Automatic HTTPS Rewrites is turned on, so that Cloudflare changes http:// links in your HTML pages to https:// when the linked resource is known to support HTTPS. This helps prevent mixed content, where a secure page loads insecure resources.
Rationale
When an HTTPS page loads images, scripts, or styles over plain HTTP, browsers may block them or warn users, and the insecure resources can be read or changed in transit. Automatic HTTPS Rewrites fixes many of these links automatically, keeping pages secure and working correctly.
Impact
Reduces mixed-content warnings and errors
Keeps more page resources loaded over HTTPS
Does not rewrite every link, so some mixed content may still need fixing in code
Default Value
Automatic HTTPS Rewrites may be turned off for a zone.
Pre-Requisites
Cloudflare account with Administrator or Super Administrator role for the zone
Test Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to SSL/TLS > Edge Certificates.
Check the Automatic HTTPS Rewrites setting and verify that it is On.
If it is not On, follow the implementation steps.
Implementation Steps
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to SSL/TLS > Edge Certificates.
Set Automatic HTTPS Rewrites to On.
Backout Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to SSL/TLS > Edge Certificates.
Set Automatic HTTPS Rewrites back to its previous value.
Reference
https://developers.cloudflare.com/ssl/edge-certificates/additional-options/automatic-https-rewrites/