How to enable Always Use HTTPS in Cloudflare
If you want every visitor to land on the secure version of your site, Cloudflare makes that easy with the Always Use HTTPS setting.
This guide explains how the feature works, where to find it, and what to check so your redirects behave correctly.
HTTPS is more than a browser padlock: it protects data in transit, supports modern browser features, and helps avoid duplicate HTTP and HTTPS URLs in search engines.
The details matter, though, because an incorrect setup can create redirect loops or mixed-content issues.
What Always Use HTTPS does
Always Use HTTPS forces Cloudflare to redirect all HTTP requests to HTTPS at the edge before the request reaches your origin server.
In practice, that means a visitor who types http://example.com is sent to https://example.com automatically.
This setting is especially useful when you want a simple, global redirect without editing server rules.
It is handled by Cloudflare’s network, so the redirect can occur even if your origin server is not configured for HTTPS redirects.
Before you enable it
Check a few basics first to avoid problems after activation.
- SSL/TLS mode: Set Cloudflare SSL/TLS to a valid mode such as Full or Full (strict) if your origin supports HTTPS.
- Origin certificate: Make sure your origin server can serve HTTPS, ideally with a trusted certificate or a Cloudflare Origin Certificate.
- Canonical URLs: Confirm your website uses HTTPS in internal links, sitemaps, and canonical tags.
- Mixed content: Prepare to update any hard-coded HTTP assets such as images, scripts, or stylesheets.
If your site still loads key resources over HTTP after the redirect, browsers may display warnings or block content.
That is common on older sites with legacy theme files or plugins.
How to enable Always Use HTTPS in Cloudflare
Follow these steps in the Cloudflare dashboard.
- Sign in to Cloudflare and select the domain you want to configure.
- Open SSL/TLS from the left-hand menu.
- Go to the Edge Certificates tab.
- Find Always Use HTTPS.
- Toggle the feature On.
Cloudflare applies the redirect at the edge, so the change is usually immediate.
After enabling it, test several URL variations, including the bare domain, www and non-www versions, and deep links to content pages.
How the redirect behaves
When enabled, Cloudflare typically sends an HTTP-to-HTTPS redirect using a 301 status code.
That is the standard permanent redirect search engines understand and index over time.
Cloudflare can also preserve the full path and query string, which means a visitor to http://example.com/blog/post?utm_source=test should end up at the corresponding HTTPS URL with the same page path and parameters.
This is useful for marketing tracking and referral consistency.
What happens with www and non-www?
Always Use HTTPS does not decide whether your preferred hostname is www or non-www.
It only upgrades the scheme from HTTP to HTTPS.
If you need hostname normalization, set that separately using a page rule, redirect rule, or your origin server configuration.
Best practices for SEO and site consistency
Search engines such as Google treat HTTPS as the preferred secure protocol when signals are consistent.
To keep indexing clean, align the redirect with the rest of your technical SEO setup.
- Update internal links to HTTPS so crawlers do not keep requesting the HTTP version.
- Use HTTPS in XML sitemaps and submit the current sitemap in Google Search Console.
- Set canonical tags to the HTTPS version of each page.
- Check hreflang annotations if your site uses multiple languages or regional variants.
- Make sure your analytics, ad pixels, and tag manager containers are loading secure resources.
If you are migrating from HTTP to HTTPS, Always Use HTTPS is just one part of the process.
You still need to audit mixed content, cache settings, and redirects from any old URLs that may already exist in backlinks.
How to test that it works
After enabling the feature, verify the behavior from a browser and with command-line tools.
- Type the HTTP version of your URL directly into the browser.
- Confirm it lands on the HTTPS version without errors.
- Use curl -I http://example.com to inspect the response headers and status code.
- Check that the final destination resolves to the intended canonical URL.
You can also use browser developer tools to inspect the redirect chain.
If you see multiple hops, investigate whether both Cloudflare and your origin server are issuing separate redirects.
Common issues and fixes
Even a simple HTTPS redirect can go wrong if the surrounding configuration is inconsistent.
Redirect loops
A loop often happens when Cloudflare is set to Flexible SSL while the origin also redirects to HTTPS.
In that setup, Cloudflare may request HTTP from the origin while the origin insists on HTTPS, creating a cycle.
Use Full or Full (strict) when possible.
Mixed content warnings
If the page loads securely but certain images, fonts, or scripts use HTTP, browsers may block them or flag the page as partially secure.
Search your codebase, theme files, and database content for hard-coded HTTP references.
Unexpected duplicate redirects
If your origin already forces HTTP to HTTPS, you may not need additional redirect logic for the same host.
Duplicate rules can slow down the first request and make debugging more difficult.
Keep one source of truth where possible.
When to use Always Use HTTPS versus other Cloudflare features
Always Use HTTPS is the simplest option when your goal is a broad HTTP-to-HTTPS upgrade for all traffic.
It is not a replacement for every redirect scenario.
- Use Always Use HTTPS for automatic scheme upgrades across the domain.
- Use Redirect Rules when you need path-based, hostname-based, or conditional redirects.
- Use server-side redirects when application logic must control the final destination.
Many site owners use Always Use HTTPS for the global rule and then add Redirect Rules for more specific canonicalization, such as forcing non-www to www or consolidating legacy content paths.
Security and performance benefits
HTTPS protects users from passive network interception and helps ensure data integrity.
It also improves compatibility with modern browser requirements, since features like HTTP/2, service workers, and certain API capabilities depend on secure origins.
From a performance standpoint, Cloudflare’s edge-based redirect is efficient because it avoids unnecessary origin requests for plain HTTP traffic.
That can reduce load on your server and simplify your redirect stack.
Useful checks after activation
- Verify the site resolves consistently over HTTPS on desktop and mobile.
- Confirm your certificate covers all active hostnames and subdomains.
- Monitor logs for unexpected HTTP requests after the change.
- Watch search engine indexing to ensure only HTTPS URLs are being discovered.
- Review third-party integrations that may still point to HTTP endpoints.
Once your settings are stable, the combination of Cloudflare edge redirects, correct SSL/TLS mode, and updated site references provides a clean HTTPS experience for users and crawlers alike.