Docs

Forcing HTTPS

HTTPS Is Enforced by Default

Every site behind the WAF forces HTTPS automatically. When a visitor requests any page over plain http, the edge responds with a 301 Moved Permanently redirect to the same URL over https before the request ever reaches your application.

Browser WAF Edge Your App 1. http:// request 2. 301 redirect to https:// 3. https:// request 4. proxied over HTTPS

Your application only ever receives the HTTPS request in step 4. The plain HTTP request never gets past the edge.

There is nothing to configure. The redirect is enabled when your site is provisioned and there is no option to turn it off.

What This Means for Your Application

  • Keep any HTTP-to-HTTPS redirect logic your application already has (for example config.force_ssl = true in Rails). The edge redirect covers traffic that reaches the WAF, but your own redirect is still what protects requests that reach your application directly, so together they give you end-to-end protection.
  • Old http:// links, bookmarks, and search results keep working. Visitors land on the HTTPS version of the same page.
  • The redirect covers every path on your domain, not just the homepage.

Going Further: HSTS

The 301 redirect protects the request after it reaches us, but the visitor’s very first request still starts as plain HTTP. The Strict-Transport-Security header (HSTS) closes that gap by telling browsers to skip the HTTP step entirely on future visits. See Enabling HSTS for how to set it up.

Need Help?