Serve the site over HTTPS on Cloudflare

Why it matters

Without HTTPS everything visitors send and receive, including passwords and form data, can be read or changed by anyone on the network path. Browsers also label plain http pages as not secure.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Check that the DNS record for example.com is Proxied (orange cloud). Only proxied records get Cloudflare's edge certificate; a DNS only record serves your server's certificate, so use your server's tab instead.
2. Open SSL/TLS, Overview and make sure the encryption mode is not Off. Then open SSL/TLS, Edge Certificates and confirm the Universal SSL certificate is Active for this host.
3. Prefer Full (strict) as the encryption mode: install a certificate on the origin (a public one or a free Cloudflare Origin CA certificate) so the connection from Cloudflare to your server is encrypted too. Flexible leaves that leg in plain http.
4. Stage 2: once https://example.com/ works on every page, turn on Always Use HTTPS under SSL/TLS, Edge Certificates.

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Stop redirecting HTTPS to HTTP
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Redirect HTTP straight to HTTPS
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS