How to force a site to open only on https?

Question

cloudflare

There is a WordPress site hosted on arubacloud (ubuntu 16.04). Vesta control panel. The domain is directed to cloudflare (free), SSL is set to "Flexible" In WordPress, in the general settings, the site address is set as https://name.site When you enter the address in full (with a protocol), it opens both via http and https. when you enter only the site name site.name or www.site.name opens via http. Admin panel opens immediately on https
How to make (correctly) that the site opens only on https? Where to dig? Vesta, .htaccess, wordpress?
check result via https://2ip.ru/ssl-info/
------------------------------------ ---------------------------
Name Let's Encrypt Authority X3
Company Let's Encrypt
Localization US
Validity period from 03/17/2016 to
03/17/2021 Serial number 13298795840390663119752826058995181320
Signature algorithm RSA-SHA256
Certification authority DST Root CA X3

Answer 1

redirect to https server in http server settings.
add an HSTS header to your site so that later client browsers don't try to connect via http

Answer 2

Maybe the problem is in the .htaccess file, there is a forced redirect.
RewriteEngine On
RewriteCond %{HTTPS} =off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [QSA,L]
don't forget to write higher from www to without www (or vice versa)
RewriteEngine On
RewriteCond % {HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

Answer 3

Even easier: in the cloudflare settings in the Crypto tab: