Check ID: zone_automatic_https_rewrites_enabled
Provider: Cloudflare
Service: zone
Severity: MEDIUM
Categories: encryption
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Automatic HTTPS Rewrites configuration by checking if it is enabled to automatically rewrite insecure HTTP links to HTTPS, resolving mixed content issues and enhancing site security.

​
Risk

Without Automatic HTTPS Rewrites, pages may contain mixed content where HTTP resources load over HTTPS pages.
  • Confidentiality: insecure resources can be intercepted and modified by attackers
  • Integrity: browsers block or warn about mixed content, indicating potential tampering
  • User Experience: security warnings degrade trust and some browsers block mixed content entirely

​
Recommendation

Enable Automatic HTTPS Rewrites as part of a comprehensive HTTPS strategy.
  • Automatically fixes mixed content by rewriting HTTP URLs to HTTPS
  • Combine with Always Use HTTPS and HSTS for defense in depth
  • Works best when all resources are available over HTTPS
  • Monitor for resources that cannot be rewritten and fix them at the source

​
Remediation

# Enable Automatic HTTPS Rewrites to fix mixed content
resource "cloudflare_zone_settings_override" "https_rewrites" {
  zone_id = "<ZONE_ID>"
  settings {
    automatic_https_rewrites = "on" # Critical: automatically rewrites HTTP URLs to HTTPS
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_automatic_https_rewrites_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks