A permanent redirect is marked temporary

# Two hops at most: HTTPS on the same host first, then the canonical host.
# Each name is written out rather than taken from $host, so no request is redirected
# to a Host value the client made up.
server {
	listen 80;
	server_name ‹host›;
	return 301 https://‹host›$request_uri;
}

server {
	listen 80;
	server_name www.‹host›;
	return 301 https://www.‹host›$request_uri;
}

server {
	listen 443 ssl;
	server_name ‹host›;
	# The site's ssl_certificate lines belong here too.
	add_header Strict-Transport-Security "max-age=31536000" always;
	return 301 https://www.‹host›$request_uri;
}

# Two hops at most: HTTPS on the same host first, then the canonical host.
<VirtualHost *:80>
	ServerName ‹host›
	RedirectMatch 301 ^/(.*)$ https://‹host›/$1
</VirtualHost>
<VirtualHost *:80>
	ServerName www.‹host›
	RedirectMatch 301 ^/(.*)$ https://www.‹host›/$1
</VirtualHost>
<VirtualHost *:443>
	ServerName ‹host›
	# The site's SSLEngine and certificate lines belong here too.
	Header always set Strict-Transport-Security "max-age=31536000"
	RedirectMatch 301 ^/(.*)$ https://www.‹host›/$1
</VirtualHost>

‹host› {
	header Strict-Transport-Security "max-age=31536000"
	redir https://www.‹host›{uri} permanent
}

SSL/TLS → Edge Certificates → Always Use HTTPS: on (hop one, the upgrade on the same name).
SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS): enable, Max Age 12 months; turn on includeSubDomains only once every subdomain serves HTTPS. Hop one exists so that ‹host› sends this header; without it the extra hop buys nothing.
Rules → Overview → Create rule → Redirect Rule: when Hostname equals ‹host› and SSL/HTTPS is on, Dynamic redirect to concat("https://www.‹host›", http.request.uri.path), status 301, preserve query string (hop two).
Then confirm with curl -sSI https://‹host›/ that the 301 carries a Strict-Transport-Security header.
(Dashboard paths and option names as at 2026-10, a dated snapshot; Cloudflare reorganises these pages and may again.)