Always use HTTPS
Always use HTTPS redirects every request that reaches a property over plain HTTP to the same URL over HTTPS. It is on by default for every property, so you don't need a rule for it.
How it works
A request to http://www.example.com/shop?page=2 gets a 301 Moved Permanently to https://www.example.com/shop?page=2 — same host, path and query string. The redirect is answered by the edge itself: the request never reaches your origin.
Certificate validation is not affected: Let's Encrypt's HTTP-01 challenges (/.well-known/acme-challenge/) are still answered over HTTP, so certificates keep issuing and renewing.
Turn it off
In the panel, open the property's Security tab and switch off Always use HTTPS in the HTTPS card. Through the API it is the always_use_https field of the property's general settings:
{
"always_use_https": false
}
General settings are saved as a whole object — see Browser caching & query strings for the GET-then-PUT workflow that avoids overwriting other settings.
Only turn it off if something must keep working over plain HTTP (an old device or client that cannot do TLS, for example).
Automatic HTTPS rewrites (mixed content)
A page served over HTTPS that links its CSS, scripts or images with http:// URLs is mixed content: browsers block those resources and the page breaks. It is common on WordPress sites whose WordPress Address / Site Address are still set to http://.
Automatic HTTPS rewrites fixes it at the edge: HTML responses get the upgrade-insecure-requests directive in their Content-Security-Policy, and the browser loads every http:// resource of the page over HTTPS instead of blocking it. It is on by default. The directive is added to any policy the response already has (your origin's, a header rule's, or the clickjacking protection's frame-ancestors); it never replaces it.
Turn it off in the same HTTPS card of the Security tab, or with "automatic_https_rewrites": false in the general settings.
The rewrite needs every resource to be available over HTTPS — a third-party host without HTTPS still fails. On WordPress, setting both addresses to https:// in Settings → General removes the problem at the source and saves each resource a redirect.
Go further with HSTS
The redirect protects a visitor from the second request on, but the very first one still travels over HTTP. HSTS tells the browser to use HTTPS directly for your domain from then on, without trying HTTP at all.