Back to Checks
cloudflare

Always Use HTTPS is enabled

zone_https_redirect_enabled
Service: zoneSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Zone

Cloudflare zones are assessed for Always Use HTTPS setting by checking if it is enabled to automatically redirect all HTTP requests to HTTPS, enforcing encrypted transport for all visitors.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without automatic HTTPS redirects, users may access resources over unencrypted HTTP.

  • Confidentiality: traffic can be intercepted and read by attackers on the network path
  • Integrity: HTTP responses can be modified in transit (content injection, malware insertion)
  • Authentication: session cookies and credentials may be transmitted in plaintext

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_https_redirect_enabled

Recommendation

Enable Always Use HTTPS to enforce encrypted connections for all visitors.

  • Combine with HSTS to prevent SSL stripping attacks
  • Ensure all resources (images, scripts, stylesheets) are served over HTTPS
  • Test for mixed content warnings before enabling

Remediation

Terraform

# Enable Always Use HTTPS to redirect HTTP to HTTPS
resource "cloudflare_zone_setting" "always_use_https" {
  zone_id    = "<ZONE_ID>"
  setting_id = "always_use_https"
  value      = "on" # Critical: forces all traffic to use encrypted HTTPS
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to SSL/TLS > Edge Certificates
3Scroll to Always Use HTTPS
4Toggle the setting to On
5Verify that your site works correctly over HTTPS

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_https_redirect_enabled(Check):
    """Ensure that Always Use HTTPS redirect is enabled for Cloudflare zones.

    The Always Use HTTPS setting automatically redirects all HTTP requests to
    HTTPS, ensuring that all traffic to the zone is encrypted. This prevents
    man-in-the-middle attacks and protects sensitive data transmitted between
    clients and the origin server.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the HTTPS redirect enabled check.

        Iterates through all Cloudflare zones and verifies that the
        always_use_https setting is turned on. When enabled, Cloudflare
        automatically redirects all HTTP requests to their HTTPS equivalents.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if
            Always Use HTTPS is enabled ('on'), or FAIL status if the
            setting is disabled for the zone.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            if zone.settings.always_use_https == "on":
                report.status = "PASS"
                report.status_extended = (
                    f"Always Use HTTPS is enabled for zone {zone.name}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Always Use HTTPS is not enabled for zone {zone.name}."
                )
            findings.append(report)
        return findings

References