Automatic HTTPS Rewrites safely rewrite HTML source links from HTTP to HTTPS without requiring manual URL changes to resources in your HTML source.
Overview
If you currently connect to your site over HTTPS and the lock icon is not present in the URL or displays a warning icon, your site may contain references to HTTP assets. See our guide on troubleshooting mixed content for further details.
Enable Automatic HTTPS Rewrites via the Crypto app to rewrite HTTP resources as HTTPS at Cloudflare without making any changes to the HTML source at your origin server.
Limitations
Before a rewrite is applied, the HTTP resources are checked to ensure they are accessible via HTTPS. In cases where a resource is not available over HTTPS, Cloudflare cannot rewrite the URL.
There may also be some resources loaded by JavaScript or CSS via HTTP when the site is loaded in a browser. In those situations, mixed content warnings will still appear. To determine which URLs do not have HTTPS support, Cloudflare uses data from EFF’s HTTPS Everywhere and Chrome’s HSTS preload list.