Why is it safe to redirect url http to https on both .htaccess and cloudflare?
Please have in mind that requests to domain.com and www.domain.com go to different places - the requests to the main domain go directly to your account while the requests to your www.domain.com go to Cloudflare:
Code:
www.domain.com. 1400 IN CNAME
www.domain.com.cdn.cloudflare.net.
On both .htaccess and on the Cloudflare's side there is a redirection for any request to be served through the secure https:// connection.
This means that even if by any chance a request goes to your domain.com without being redirected to www.domain.com it will still be served through the secure https:// connection.
Therefore it is the best practice to have both rules on your .htaccess and on your Cloudflare's account.