Back to Checks
cloudflare

Automatic HTTPS Rewrites is enabled

zone_automatic_https_rewrites_enabled
Service: zoneSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Zone

Cloudflare zones are assessed for Automatic HTTPS Rewrites configuration by checking if it is enabled to automatically rewrite insecure HTTP links to HTTPS, resolving mixed content issues and enhancing site security.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without Automatic HTTPS Rewrites, pages may contain mixed content where HTTP resources load over HTTPS pages.

  • Confidentiality: insecure resources can be intercepted and modified by attackers
  • Integrity: browsers block or warn about mixed content, indicating potential tampering
  • User Experience: security warnings degrade trust and some browsers block mixed content entirely

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_automatic_https_rewrites_enabled

Recommendation

Enable Automatic HTTPS Rewrites as part of a comprehensive HTTPS strategy.

  • Automatically fixes mixed content by rewriting HTTP URLs to HTTPS
  • Combine with Always Use HTTPS and HSTS for defense in depth
  • Works best when all resources are available over HTTPS
  • Monitor for resources that cannot be rewritten and fix them at the source

Remediation

Terraform

# Enable Automatic HTTPS Rewrites to fix mixed content
resource "cloudflare_zone_settings_override" "https_rewrites" {
  zone_id = "<ZONE_ID>"
  settings {
    automatic_https_rewrites = "on" # Critical: automatically rewrites HTTP URLs to HTTPS
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to SSL/TLS > Edge Certificates
3Scroll to Automatic HTTPS Rewrites
4Toggle the setting to On
5Verify that your site loads correctly without mixed content warnings

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_automatic_https_rewrites_enabled(Check):
    """Ensure that Automatic HTTPS Rewrites is enabled for Cloudflare zones.

    Automatic HTTPS Rewrites automatically rewrites insecure HTTP links to HTTPS,
    resolving mixed content issues and enhancing site security. This feature scans
    HTML responses and rewrites HTTP URLs to HTTPS for resources that are known to
    be available over a secure connection, preventing mixed content warnings.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the Automatic HTTPS Rewrites enabled check.

        Iterates through all Cloudflare zones and verifies that Automatic HTTPS
        Rewrites is enabled. This setting automatically fixes mixed content issues
        by rewriting HTTP links to HTTPS where possible.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if Automatic
            HTTPS Rewrites is enabled, or FAIL status if it is disabled for the zone.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            automatic_https_rewrites = (
                zone.settings.automatic_https_rewrites or ""
            ).lower()
            if automatic_https_rewrites == "on":
                report.status = "PASS"
                report.status_extended = (
                    f"Automatic HTTPS Rewrites is enabled for zone {zone.name}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Automatic HTTPS Rewrites is not enabled for zone {zone.name}."
                )
            findings.append(report)
        return findings

References