2

I want to ensure that all traffic coming to my servers (including a wordpress server and others hosted on Google comopute) via Cloudflare are https only.

At the moment I used this page rule:

enter image description here

Then I realised there is this option:

enter image description here

Which is the more preferred method to achieve the goal (for example in term of performance)?

Anthony Kong
  • 3,288
  • 11
  • 57
  • 96

1 Answers1

2

I wouldn't worry about performance with either, because both are documented and supported methods and serving HTTPS consumes more resources than any redirect on HTTP anyway. Your goal is to ensure that all traffic is https only. With HTTP Strict Transport Security (HSTS, RFC 6797) you can ensure that. There's also difference in performance as the URLs are rewritten client side.

Cloudflare blog How to make your site HTTPS-only suggests using the HTTPS-only feature and suggests HSTS as the next step. A blog post from when HSTS was first introduced in Cloudflare beta dashboard explains this more thoroughly and also warns it's more permanent than redirecting:

There is one caveat to HSTS: it's a policy cached in each browser. If you configure HSTS settings, browsers will cache those settings for the duration of max-age. We recommend 6 months. If your site becomes inaccessible over strongly-configured HTTPS, web browsers will refuse to connect to the site on HTTP until the policy expires in the browser. Therefore, it's important that you set up HSTS only after establishing a stable SSL configuration. Fortunately, CloudFlare's default SSL settings are perfectly compatible with HSTS.

Esa Jokinen
  • 46,944
  • 3
  • 83
  • 129