Redirect HTTP straight to HTTPS on Cloudflare
Why it matters
The first redirect from http:// goes to another http:// address, so the visitor's request travels unencrypted twice before reaching https. The name the visitor typed also never gets an HSTS header, which is only honoured over https.
The fix
- Turn on Always Use HTTPS (SSL/TLS, Edge Certificates) so every http request is first sent to https on the same host.
- Check Rules, Overview for Redirect Rules or Page Rules whose target URL starts with http:// and change them to https://.
Related
- Reported by the HTTP to HTTPS redirect check
- Serve the site over HTTPS
- Stop redirecting HTTPS to HTTP
- Redirect HTTP to HTTPS
- Fix the broken HTTPS redirect chain
- Shorten the redirect chain
- Fix the HTTP redirect chain
- Answer HTTP with a redirect to HTTPS
- Redirect www and apex to one host
- Make the www or apex name work over HTTPS
Scan your domain to see whether this applies to you.