Cloudflare Always Use HTTPS: A Guide for Website Owners

If visitors can still open a site using an http:// address, Cloudflare’s Always Use HTTPS setting redirects those requests to https:// across all subdomains and hosts in the application. Enable it in Cloudflare’s dashboard under SSL/TLS → Edge Certificates, provided the site’s SSL/TLS encryption mode is not Off and the relevant parts of the site support HTTPS. The setting handles the redirect; it does not replace certificates or fix mixed-content problems.

What Always Use HTTPS does#

An HTTP-to-HTTPS redirect tells a visitor’s browser to request the secure URL instead. Cloudflare documents Always Use HTTPS as a Cloudflare-specific setting for applying that redirect broadly across an application.

The redirect and the encryption are separate parts of the process. Cloudflare’s SSL/TLS documentation explains that an edge certificate protects traffic between visitors and Cloudflare, while an origin certificate protects the Cloudflare-to-server connection.

How to enable it in Cloudflare#

1. Open the Cloudflare dashboard and select the relevant site or application.
2. Go to SSL/TLS → Edge Certificates.
3. Locate Always Use HTTPS and enable it.
4. Before enabling the setting, confirm that the SSL/TLS encryption mode is not Off.

Cloudflare’s Always Use HTTPS documentation describes this dashboard setting and its scope.

Check these conditions first#

• Only part of the site supports HTTPS: Do not apply the broad setting to an application where some parts are not ready for HTTPS. Cloudflare recommends a selective redirect in that situation.
• The origin already redirects traffic: Review redirects configured on the origin server. Cloudflare cautions that origin redirects can create redirect loops.
• Page resources still use HTTP: Forcing the page URL to HTTPS does not repair images, scripts, stylesheets, or other resources that still load over HTTP. Update those resource URLs to use HTTPS or relative links.

For an application whose subdomains and hosts support HTTPS, Always Use HTTPS provides a single Cloudflare setting for redirecting HTTP requests. When HTTPS is supported only on part of the site, use a selective redirect instead and address the remaining certificate and mixed-content issues separately.