What the check looks at
A3 reads the two addresses WordPress stores, home (Site Address) and siteurl (WordPress Address), and compares them with the scheme visitors arrive with, as Cloudflare reports it in the CF-Visitor header, read the same way as check A2.
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: High | Your site addresses use https Both addresses are stored with https, which matches how visitors arrive. |
| WarningConfidence: High | Your site addresses are still stored with http Visitors arrive over https, but at least one of the two addresses starts with http://. Every link WordPress builds from it costs an extra redirect, and it can turn into a loop. |
| Could not checkConfidence: Low | This check could not be completed The plugin has not seen the scheme a visitor arrives with, or visitors are not arriving over https, so there is nothing to compare. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
no_snapshot: This check needs a recent visit through Cloudflare. Open the Edge Doctor report once and it will have one. On A3 it covers both cases: no recent visit through Cloudflare to read, or a visit that did not arrive over https.not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- Links, images or redirects on the site point to http:// and the browser follows an extra redirect for each.
- Mixed content warnings, or a redirect loop when the server and Cloudflare disagree about the scheme (check A4).
Why it happens
WordPress builds its links from these two stored addresses. A site that started on http and moved to https behind Cloudflare often keeps the old values, and a plugin that forces https hides it.
Confirm it by hand
In WordPress, open Settings, General and read WordPress Address (URL) and Site Address (URL). With WP-CLI:
wp option get home
wp option get siteurlHow to fix it
In WordPress: change both addresses to https under Settings, General. If either field is greyed out, it is set in wp-config.php with WP_HOME or WP_SITEURL; change it there.
Do this only when https works end to end, that is after check A2 passes. Old http links inside your content stay as they are; a search and replace tool updates them.
In Cloudflare: Always Use HTTPS redirects every http request to https at the edge, so visitors who type http still land on https. Cloudflare recommends against redirecting at the origin as well, which can cause loops.
Limitations
A3 compares stored values with one observed visit. It does not scan your content for hard-coded http:// links.
Related checks
- A2 Flexible SSL: whether Cloudflare reaches your server over https.
- A4 Redirect loops and HTTP to HTTPS: redirect loops and the switch to https.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.