Cloudflare Automatic HTTPS Rewrites: A Guide for Website Owners

Cloudflare Automatic HTTPS Rewrites can reduce mixed-content warnings on an HTTPS page by changing eligible http:// resource and link URLs to https:// when those resources are available over HTTPS. To enable it, open the Cloudflare dashboard, go to Edge Certificates, and switch Automatic HTTPS Rewrites to On. You must still fix HTTP-only resources and URLs that Cloudflare cannot rewrite.

What the feature does#

Mixed content occurs when an HTTPS page references resources or links over HTTP. Cloudflare's feature checks eligible URLs and rewrites them to HTTPS when the referenced resource is available through HTTPS. This can help a page use secure URLs without requiring every reference to be changed manually first.

The rewrite does not make an HTTP-only resource available over HTTPS. If a script, stylesheet, image, or linked page is not served over HTTPS, Cloudflare cannot safely rewrite that URL. Changing such a URL to HTTPS manually may cause it to fail unless the resource is configured for HTTPS.

How to enable Automatic HTTPS Rewrites#

1. Sign in to the Cloudflare dashboard.
2. Open Edge Certificates.
3. Set Automatic HTTPS Rewrites to On.

Cloudflare also documents API controls and configuration rules for applying the setting to specific hostnames. Use those controls when the rewrite behavior needs to be managed programmatically or limited by hostname.

What to check afterward#

Automatic HTTPS Rewrites may not change every mixed-content reference. Cloudflare notes that some resources loaded by JavaScript or CSS can continue to produce warnings, and passive content such as images may remain unchanged in some cases.

After enabling the setting:

• Load affected HTTPS pages and inspect any remaining mixed-content warnings.
• Change URLs that your site controls from http:// to https:// when the resource supports HTTPS.
• Consider relative URLs where they are appropriate for your site.
• Ask third-party providers to supply HTTPS URLs, or replace references that remain HTTP-only.
• Confirm that each replacement URL actually serves the intended resource over HTTPS.

This review is necessary because the feature handles eligible URLs at Cloudflare's edge; it is not a guarantee that every reference embedded in page content will be rewritten.

How this relates to SSL/TLS#

Automatic HTTPS Rewrites changes eligible URLs in page content. It does not itself provide the complete SSL/TLS configuration for a website. Cloudflare's SSL/TLS documentation explains that certificates encrypt traffic and distinguishes the connection between visitors and Cloudflare from the connection between Cloudflare and the origin server.

For a secure site, check both areas: use HTTPS URLs for page resources and links, and make sure the relevant visitor-to-Cloudflare and Cloudflare-to-origin connections have the SSL/TLS configuration your site requires.