Stop redirecting HTTPS to HTTP on Cloudflare
Why it matters
The HTTPS homepage sends visitors back to plain http, so the encrypted connection is thrown away and their traffic is exposed again. It usually means the application believes its address starts with http:// or a redirect rule points the wrong way.
The fix
- Open SSL/TLS, Overview. With Flexible, Cloudflare talks to your server over plain http, and applications that build URLs from the request scheme redirect to http. Install a certificate on the origin and switch to Full (strict).
- Open Rules, Overview and check Redirect Rules and Page Rules for any rule whose target URL starts with http://; change it to https://.
- If the origin still redirects to http, fix it there with your server's or application's tab.
Related
- Reported by the HTTP to HTTPS redirect check
- Serve the site over HTTPS
- Redirect HTTP to HTTPS
- Fix the broken HTTPS redirect chain
- Shorten the redirect chain
- Fix the HTTP redirect chain
- Redirect HTTP straight to HTTPS
- Answer HTTP with a redirect to HTTPS
- Redirect www and apex to one host
- Make the www or apex name work over HTTPS
Scan your domain to see whether this applies to you.