# Ensure Automatic HTTPS Rewrites is enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787219093265-ensure-automatic-https-rewrites-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Automatic HTTPS Rewrites is turned on, so that Cloudflare changes http:// links in your HTML pages to https:// when the linked resource is known to support HTTPS. This helps prevent mixed content, where a secure page loads insecure resources.

**Rationale**

When an HTTPS page loads images, scripts, or styles over plain HTTP, browsers may block them or warn users, and the insecure resources can be read or changed in transit. Automatic HTTPS Rewrites fixes many of these links automatically, keeping pages secure and working correctly.

**Impact**

-   Reduces mixed-content warnings and errors
    
-   Keeps more page resources loaded over HTTPS
    
-   Does not rewrite every link, so some mixed content may still need fixing in code
    

**Default Value**

Automatic HTTPS Rewrites may be turned off for a zone.

**Pre-Requisites**

-   Cloudflare account with Administrator or Super Administrator role for the zone
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Check the Automatic HTTPS Rewrites setting and verify that it is On.
    
5.  If it is not On, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Set Automatic HTTPS Rewrites to On.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Set Automatic HTTPS Rewrites back to its previous value.
    

**Reference**

-   [https://developers.cloudflare.com/ssl/edge-certificates/additional-options/automatic-https-rewrites/](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/automatic-https-rewrites/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.