5

I set it up, and set "Automatic HTTPS Rewrites" to "ON", BUT this still not redirecting me to the https by default when the page is requested via http... accessing the page manually by putting https at the url is working fine.

Any ideas how to solve this, please?

  • What flavour of SSL do you have with Cloudflare? – MrWhite Mar 30 '17 at 16:46
  • what do you mean by that, please? I selected the Flexible option and it says Active... – prizzaloo Mar 30 '17 at 16:47
  • Yes, that's what I meant: "Flexible", "Full" or "Full (Strict)". (That might be irrelevant anyway as it happens - the "Flexible" option is only encrypted to CF, the connection from CF to your site is still unencrypted.) I notice on the CF site that "To determine which URLs do not have HTTPS support, we use data from EFF’s HTTPS Everywhere and Chrome’s HSTS preload list, among others." - that may have a bearing on whether CF will rewrite the URL. Most sites do this manually in the server config. – MrWhite Mar 30 '17 at 17:03
  • Hm... So, I guess my server doesn't. Anyway I can do it by my end(as a user of the hosting without access to the server config)? Or perhaps there's any further reading on that... I'm just totally lost with it. – prizzaloo Mar 30 '17 at 17:11
  • Or by server config, you actually meant to use, say .htaccess file? If so, again, where do I find info what to put in it? – prizzaloo Mar 30 '17 at 17:13
4

If you are having problems with the "Automatic HTTPS Rewrites" Cloudflare option then it maybe that CF is unable to determine whether your site/resources are HTTPS enabled. From the CF docs on Automatic HTTPS Rewrites:

To determine which URLs do not have HTTPS support, we use data from EFF’s HTTPS Everywhere and Chrome’s HSTS preload list, among others.

To unconditionally redirect all users to HTTPS the preferred method would seem to be to create a page rule. From the CF support doc: How do I redirect all visitors to HTTPS/SSL?

The most effective means of redirecting visitors to HTTPS when using Cloudflare is using a page rule. While you can also redirect to HTTPS using configuration at your origin, page rules are processed at our edge, resulting in a quicker response and reduced requests to your server.

The "Always use HTTPS” action is the simplest option to redirect HTTP requests to HTTPS.

The following steps describe the process of using page rules (which will behave as a 301 redirect):

Cloudflare Page Rule 301 Redirect from HTTP to HTTPS

  1. Login to Cloudflare
  2. Select your site using the dropdown menu found in the upper left corner
  3. Click the Page Rules icon at the top of the screen
  4. Click the Create Page Rule button
  5. Enter http://*example.com/* but obviously changing the domain with yours.
  6. Under “Then the settings are:” click + Add a Setting
  7. Click the dropdown list, find and click option “Always Use HTTPS”
  8. Finally click Save and Deploy

However, many users still use their own server config (by that I literally mean either the main server config, virtual host or .htaccess file) and mod_rewrite (Apache) to perform the redirect. However, on the CF "Flexible SSL" option you need to be careful of a redirect loop, since your site is still serving content over HTTP to CF, so ordinary HTTPS checks cannot be applied. (The CF "Flexible SSL" option just protects the connection from the end-user to CF, not the connection from CF to your server.)

So, something like the following near the top of your .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule (.*) https://example.com/$1 [R=301,L]

With "Flexible SSL" the HTTPS server variable is always off (since your site is serving content over HTTP), but Cloudflare should be setting the X-Forwarded-Proto HTTP request header as the request passes through Cloudflare's servers. Keeping the first condition ensures it should work regardless of whether you are using CF or not. If you are always going to be behind a proxy (CF) then you can remove the first condition.

...so seems like HTST is not really a great idea...

If you are committed to HTTPS then HSTS is a great idea. However, it is a one-way ticket. You will not be able to (easily) revert back to HTTP.

| improve this answer | |
  • Thanks! Just to make it a little bit clear for my self: the %{HTTPS} off - the first line - is there for CF to get the http content(the original one), correct? – prizzaloo Mar 30 '17 at 19:22
  • And one more thing: at the bottom line, I need to change only the domain name, right, without touching the $1 and [R=301,L]? – prizzaloo Mar 30 '17 at 19:24
  • Actually, if you are behind CF then that first condition (%{HTTPS} off) is not strictly necessary. CF sets the X-Forwarded-Proto header (used in the second condition). However, I would say it's good practice to keep that first condition - if you moved your site or changed CF's "Flexible SSL" option then you would get a redirect loop without it. And yes, change just example.com to your canonical hostname. – MrWhite Mar 30 '17 at 19:30
  • On Apache, the HTTPS server variable contains the string "on" or "off" depending on whether the request is for HTTPS or HTTP respectively. If you had a SSL cert installed directly on your server then this would be used. – MrWhite Mar 30 '17 at 19:34
  • 1
    I'm making my life harder :) It is actually the "Automatic HTTPS Rewrites" at the "Crypto" settings... My bad. And yes, I understand it know what you meant at the prev. message. Thanks :) – prizzaloo Mar 31 '17 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.