Two related SSL settings.
ALWAYS USE HTTPS
Redirects http requests to https at the edge, before they reach us.
Enable it. It means the redirect costs you nothing and happens closer to the visitor.
If you have this on, you do not also need the cPanel Force HTTPS toggle. Two redirects doing the same job is how loops start.
Choose one. The Cloudflare one is preferable when proxied, since it happens at the edge.
AUTOMATIC HTTPS REWRITES
Rewrites http resource URLs in your pages to https as they pass through Cloudflare.
This masks mixed content rather than fixing it.
WHY THAT MATTERS
The underlying problem is http URLs stored in your database. Cloudflare rewriting them on the way out means the page looks fine while the database is still wrong.
The moment you disable Cloudflare, or a visitor bypasses it, the problem reappears.
THE PROPER FIX
A database search and replace from http to https, with a serialisation-aware tool.
USE IT AS
A temporary measure while you fix the database properly. Not a permanent solution.
