Automatic HTTPS Rewrites off (mixed-content risk)
Part of the Edge TLS posture check · fix arrives as a guide
What it is
Automatic HTTPS Rewrites is off.
Why it matters
Pages served over HTTPS that reference http:// subresources trigger mixed-content blocking, so images and scripts silently fail to load. Users see a broken page rather than a security warning.
The error this setting exists to prevent
With the setting off, a page served over HTTPS that references an http:// script, stylesheet or image gets this in every visitor’s console — and the resource is blocked, so the page visibly breaks:
Mixed Content: The page at 'https://example.com/' was loaded over HTTPS,
but requested an insecure resource 'http://example.com/app.js'.
This request has been blocked; the content must be served over HTTPS.What Automatic HTTPS Rewrites actually does
At the edge, Cloudflare rewrites http:// subresource URLs in your HTML to https:// — but only for hosts it knows can serve HTTPS. It is a safety net for legacy markup, hardcoded CDN links and CMS content you do not control, not a licence to keep writing insecure URLs. The setting lives at SSL/TLS → Edge Certificates → Automatic HTTPS Rewrites.
Check whether you are relying on it
Grep your templates and stored content for insecure references before assuming the toggle is doing nothing:
# in the repo
grep -rn 'src="http://' --include='*.html' --include='*.tsx' .
grep -rn 'href="http://' --include='*.css' .Fix it manually
Turn the setting on, then fix the sources it was papering over. A Content-Security-Policy: upgrade-insecure-requests header does the same upgrade in the browser itself and covers hosts Cloudflare’s list does not:
# _headers (Cloudflare Pages / Netlify)
/*
Content-Security-Policy: upgrade-insecure-requestsThe order matters: enable the rewrites first (instant, zero-risk), fix the markup second, and treat the CSP header as the belt-and-braces layer.
How lumioguard fixes it
The scan reads the zone setting and pairs it with any hardcoded http:// references found in the connected repo. The fix arrives as a step-by-step guide: the toggle to flip, the exact files and lines still referencing insecure URLs, and the CSP header if your host supports it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.