Description

Ensure Always Use HTTPS is turned on, so that Cloudflare redirects every HTTP request for the zone to the same URL over HTTPS with a 301 redirect. This makes sure visitors always use an encrypted connection.

Rationale

If HTTP is still allowed, visitors who type the domain without https or follow old links connect without encryption, so passwords, cookies, and data can be intercepted. Always Use HTTPS moves every request to HTTPS at Cloudflare's edge, before it reaches your origin.

Impact

  • All visitors are moved to HTTPS

  • Protects data and cookies in transit

  • The SSL/TLS encryption mode must not be Off

Default Value

Always Use HTTPS may be turned off for a zone.

Pre-Requisites

  • Cloudflare account with Administrator or SSL/TLS permissions for the zone

  • An active edge certificate and an SSL/TLS encryption mode other than Off

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. Verify that Always Use HTTPS is turned on.

  5. If it is off, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Overview and make sure the encryption mode is not Off.

  4. Go to SSL/TLS > Edge Certificates.

  5. Turn on Always Use HTTPS.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. Turn off Always Use HTTPS.

Reference