Greetings @fritex and thanks for your kind answer.
On Cloudflare WAF I added 3 Firewall rules to block common bot and some countries.
I purged all the cache and, almost since the beginning, I set “Always Use HTTPS” and " Automatic HTTPS Rewrites" on.
Currently my website is just a simple page with nothing on, except a text: “website under maintenance”.
I have some other website, made on WordPress, installed in a subfolder of my domain, and as described in the mixed content link, I installed the “SSL Insecure Content Fixer” plugin to properly redirect all the links contained in each of them.
Thank you for sharing that link and for all your suggestions.
I did again the test but I’m having the same result
