Setting Up Secure HTTPS Redirects and HSTS in Cloudflare

• Overview
• Why HSTS is required
• Step 1: Add a DNS A record
• Step 2: Enable Always Use HTTPS and configure HSTS
• Step 3: Create a redirect rule
• Non-standard HTTP ports
• Further reading

Overview

Organizations often need to redirect legacy or vanity domains to a primary domain. To do this securely, the redirect chain must pass through HTTPS on the source domain before forwarding to the destination.

This article describes how to configure secure redirects and HTTP Strict Transport Security (HSTS) in Cloudflare. Read more about HSTS

Why HSTS is required

A redirect from http://nonsecuredomain.com directly to https://www.securedomain.com is insecure. An attacker performing a DNS spoofing attack could intercept the initial HTTP request and redirect the user to a malicious domain. Because the connection is unencrypted, the user's browser cannot detect the substitution.

HSTS addresses this by instructing the browser to automatically upgrade all requests for the domain to HTTPS before any DNS lookup occurs. With HSTS in place:

• The browser rewrites http://nonsecuredomain.com directly to https://www.securedomain.com before connecting.
• If a DNS spoofing attack occurs, the browser shows a security error instead of following the attacker's redirect.
• If HSTS Preload is enabled, the browser enforces this behavior even on the first visit, and the user cannot override the security error.

For a redirect to be secure, the source domain should upgrade the request to HTTPS before forwarding it to the destination. HSTS then tells browsers to skip plain HTTP entirely on future visits. A secure redirect chain looks like this:

http://nonsecuredomain.com → https://nonsecuredomain.com → https://www.securedomain.com

Step 1: Add a DNS A record

In Cloudflare, go to DNS > Records and add an A record for the domain or subdomain you want to redirect.

• For a subdomain: enter the subdomain name in the Name field.
• For the root domain: enter @ in the Name field.
• Set the IPv4 address to any value (for example, 192.0.2.1). Cloudflare will proxy the request and this address will not be used directly.
• Ensure the record is set to Proxied (the orange cloud icon)

Step 2: Enable Always Use HTTPS and configure HSTS

Still in Cloudflare, go to SSL/TLS > Edge Certificates and configure the following settings.

1. Always Use HTTPS: Enable this toggle. This redirects all HTTP requests to HTTPS for the zone (including all Cloudflare ports). Read more about Always Use HTTPS
2. Minimum TLS Version: Select TLS 1.2 to support a broad range of browsers, or TLS 1.3 for modern browsers only. Read more about Minimum TLS Version
3. HTTP Strict Transport Security (HSTS): Click Change HSTS Settings and configure the following on the Configure tab:

• Enable HSTS (Strict-Transport-Security): On
• Max Age Header (max-age): 6 months (recommended)
• Apply HSTS policy to subdomains (includeSubDomains): On
• Preload: On
• No-Sniff Header: On

Step 3: Create a redirect rule

Cloudflare provides two methods for creating redirect rules. Use a single redirect rule for individual domains, or Bulk Redirects if you are managing multiple domains.

Option A: Single redirect rule

In Cloudflare, go to Rules > Redirect Rules and create a new rule.

1. Enter a name for the rule.
2. Under When incoming requests match, select Custom filter expression.
   1. Set Field to URI Full.
   2. Operator to starts with.
   3. Enter the source domain prefixed with https:// in the Value field.
3. Under Then:
   1. Set Type to Static
   2. Enter the destination URL (prefixed with https://) in the URL field.
4. Deploy the rule or Save as draft to enable later.

Option B: Bulk redirects

In Cloudflare, go to Rules > Settings > Bulk Redirects.

1. Click Create Bulk Redirect List and give it a name.
2. Click Or, manually add URL redirects.
3. Enter the source domain or subdomain (with a trailing slash) in Source URL, and the destination URL (prefixed with https://) in Target URL.
4. Click Edit parameters and check Include subdomains.
5. Save the list.
6. Click Create Bulk Redirect Rule and give it a name.
7. Select the redirect list you created from the Name dropdown.
8. In the expression editor, the expression will default to http.request.full_uri in $[list-name]. If prompted to switch to the expression builder, click Use expression builder and then click Discard changes to return to the editor.
9. Change the Field to SSL/HTTPS. The expression preview updates to (ssl).
10. Click Save and Deploy.

Once the rule is active, the Bulk Redirects page will show the rule as Enabled and the associated redirect list as Active.

Non-standard HTTP ports

Cloudflare designates certain ports as HTTP-only — for example, port 2052. By default, these ports do not enforce HTTPS redirection. Port 2052 should be configured to redirect traffic to its HTTPS equivalent on port 2053, in the same way that standard port 80 traffic redirects to port 443.

An accessible HTTP port that does not redirect to HTTPS presents a security risk equivalent to leaving port 80 open without a redirect. A redirect rule should be configured rather than issuing a risk waiver. You can also block traffic on non-standard ports using a WAF custom rule.

Further reading

Cloudflare has additional information you'd like to learn more:

• Single redirects overview
• Create a redirect rule in the dashboard
• Bulk Redirects (dashboard)