![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
- Overview
- Concepts
- Get started
- Edge certificates
- Overview
- Advanced certificates
- Enforce HTTPS connections
- Domain control validation (DCV)
- Geo Key ManagerBeta
- Add CAA records
- Staging environmentBeta
- Backup certificates
- ECH ProtocolBeta
- Additional options
- Origin server
- Automatic key exchange to origins
- SSL/TLS RecommenderDeprecated
- Cloudflare origin CA
- Authenticated Origin Pulls (mTLS)
- Custom Origin Trust Store
- Cipher suites
- Cloudflare for SaaS
- Keyless SSL
- Reference
- FAQ
- Changelog
Always Use HTTPS
Always Use HTTPS redirects all your visitor requests from http to https, for all subdomains and hosts in your application.
Note
This process does not impact certificate validation. If you use HTTP DCV, you can still enable Always Use HTTPS.
Cloudflare recommends not performing redirects at your origin web server, as this can cause redirect loop errors.
| Free | Pro | Business | Enterprise | |
|---|---|---|---|---|
| Availability | Yes | Yes | Yes | Yes |
To redirect traffic for all subdomains and hosts in your application, you can enable Always Use HTTPS.
Note
If only some parts of your application can support HTTPS traffic, do not enable Always Use HTTPS and use a single redirect to selectively perform the redirect to HTTPS. Refer to Redirect admin area requests to HTTPS for an example.
To enable Always Use HTTPS in the dashboard:
-
In the Cloudflare dashboard, go to the SSL/TLS Overview page.
Go to Overview ↗ -
Make sure that your SSL/TLS encryption mode is not set to Off. When you set your encryption mode to Off, the Always Use HTTPS option will not be visible in your Cloudflare dashboard.
-
Go to the Edge Certificates page.
-
Turn on Always Use HTTPS.
To enable or disable Always Use HTTPS with the API:
- Make sure that your SSL/TLS encryption mode is not set to Off.
- Send a
PATCHrequest withalways_use_httpsas the setting name in the URI path, and thevalueparameter set to your desired setting ("on"or"off").
Forcing HTTPS does not resolve issues with mixed content, as browsers check the protocol of included resources before making a request. You will need to use only relative links or HTTPS links on pages that you force to HTTPS. Cloudflare can automatically resolve some mixed-content links using our Automatic HTTPS Rewrites functionality.
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}