Check ID: zone_https_redirect_enabled
Provider: Cloudflare
Service: zone
Severity: MEDIUM
Categories: encryption
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Always Use HTTPS setting by checking if it is enabled to automatically redirect all HTTP requests to HTTPS, enforcing encrypted transport for all visitors.

​
Risk

Without automatic HTTPS redirects, users may access resources over unencrypted HTTP.
  • Confidentiality: traffic can be intercepted and read by attackers on the network path
  • Integrity: HTTP responses can be modified in transit (content injection, malware insertion)
  • Authentication: session cookies and credentials may be transmitted in plaintext

​
Recommendation

Enable Always Use HTTPS to enforce encrypted connections for all visitors.
  • Combine with HSTS to prevent SSL stripping attacks
  • Ensure all resources (images, scripts, stylesheets) are served over HTTPS
  • Test for mixed content warnings before enabling

​
Remediation

# Enable Always Use HTTPS to redirect HTTP to HTTPS
resource "cloudflare_zone_setting" "always_use_https" {
  zone_id    = "<ZONE_ID>"
  setting_id = "always_use_https"
  value      = "on" # Critical: forces all traffic to use encrypted HTTPS
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_https_redirect_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks