Understanding Automatic HTTPS rewrites

Automatic HTTPS Rewrites safely rewrite HTML source links from HTTP to HTTPS without requiring manual URL changes to resources in your HTML source. 


If you currently connect to your site over HTTPS and the lock icon is not present in the URL or displays a warning icon, your site may contain references to HTTP assets.  See our guide on troubleshooting mixed content for further details.

Enable Automatic HTTPS Rewrites via the SSL/TLS app to rewrite HTTP resources as HTTPS at Cloudflare without making any changes to the HTML source at your origin server.


Before a rewrite is applied, the HTTP resources are checked to ensure they are accessible via HTTPS. In cases where a resource is not available over HTTPS, Cloudflare cannot rewrite the URL.

There may also be some resources loaded by JavaScript or CSS via HTTP when the site is loaded in a browser. In those situations, mixed content warnings will still appear. To determine which URLs do not have HTTPS support, Cloudflare uses data from EFF’s HTTPS Everywhere and Chrome’s HSTS preload list.

If a third-party domain supports HTTPS and is not being rewritten automatically, manually change those links to relative links or HTTPS links.  Alternatively, ask the third-party domain owner to submit their site for inclusion in the HTTPS Everywhere rulesets, which accept pull requests on GitHub.

Related resources

Not finding what you need?

95% of questions can be answered using the search tool. This is the quickest way to get a response.