# Ensure Always Use HTTPS is enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787219340346-ensure-always-use-https-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Always Use HTTPS is turned on, so that Cloudflare redirects every HTTP request for the zone to the same URL over HTTPS with a 301 redirect. This makes sure visitors always use an encrypted connection.

**Rationale**

If HTTP is still allowed, visitors who type the domain without https or follow old links connect without encryption, so passwords, cookies, and data can be intercepted. Always Use HTTPS moves every request to HTTPS at Cloudflare's edge, before it reaches your origin.

**Impact**

-   All visitors are moved to HTTPS
    
-   Protects data and cookies in transit
    
-   The SSL/TLS encryption mode must not be Off
    

**Default Value**

Always Use HTTPS may be turned off for a zone.

**Pre-Requisites**

-   Cloudflare account with Administrator or SSL/TLS permissions for the zone
    
-   An active edge certificate and an SSL/TLS encryption mode other than Off
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Verify that Always Use HTTPS is turned on.
    
5.  If it is off, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Overview and make sure the encryption mode is not Off.
    
4.  Go to SSL/TLS > Edge Certificates.
    
5.  Turn on Always Use HTTPS.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Turn off Always Use HTTPS.
    

**Reference**

-   [https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.