Cloudflare SSL/TLS Modes Explained: Why Full (Strict) Beats Flexible, and How to Lock Down Your Origin
Off, Flexible, Full or Full (strict)? What each Cloudflare encryption mode really does, why Flexible is risky, and the settings that keep attackers from going around Cloudflare.
If your website runs behind Cloudflare, the SSL/TLS encryption mode controls whether the connection between Cloudflare and your server is encrypted and verified. For almost every business site the right answer is Full (strict): install a valid certificate on your server (a public one such as Let's Encrypt or AutoSSL, or a free Cloudflare Origin CA certificate) and let Cloudflare verify it. Flexible looks convenient, but it leaves the second half of the connection unencrypted and is the most common cause of "too many redirects" errors. This guide explains each mode, the settings that go with it, and how to stop attackers from going around Cloudflare to reach your server directly.
Two connections, not one
When a visitor opens your proxied website, there are two separate connections:
- Visitor to Cloudflare. Cloudflare presents its own edge certificate here, which is why the padlock appears even if your server has no certificate at all.
- Cloudflare to your server (the origin). The encryption mode controls this connection.
The padlock in the browser only tells the visitor about the first connection. The second one is your responsibility.
The encryption modes explained
You choose the mode on the SSL/TLS > Overview page of the Cloudflare dashboard. You can also set it per hostname with a Configuration Rule.
| Mode | Cloudflare to origin | Certificate checked? | Use it when |
|---|---|---|---|
| Off | Plain HTTP | No | Never for a business site |
| Flexible | Plain HTTP | No | Only temporarily, while the origin gets a certificate |
| Full | HTTPS if the visitor used HTTPS | No | The origin has a self-signed or expired certificate (temporary) |
| Full (strict) | HTTPS if the visitor used HTTPS | Yes | The recommended setting |
| Strict (SSL-Only Origin Pull) | Always HTTPS | Yes | You want HTTPS to the origin even for HTTP visitors |
Cloudflare also has an Automatic SSL/TLS option. Its SSL/TLS Recommender scans your origin and moves the zone to the most secure mode the origin supports, and Cloudflare says it will never lower your setting to a less secure mode. That is useful, but we still recommend confirming the mode by hand after any server or certificate change.
Why Flexible is a problem
With Flexible, Cloudflare connects to your server over plain HTTP. Two things go wrong:
- The traffic is unencrypted between Cloudflare and your server. Logins, form submissions and customer data travel in clear text on that hop, while visitors see a padlock and assume everything is protected.
- Redirect loops. Most modern sites (WordPress, cPanel hosting with forced HTTPS, most frameworks) redirect HTTP to HTTPS. Cloudflare sends an HTTP request, your server redirects it to HTTPS, Cloudflare sends HTTP again, and the browser eventually shows
ERR_TOO_MANY_REDIRECTS. Cloudflare's own troubleshooting guide names this as the cause.
The fix is to put a certificate on the origin and switch to Full (strict), not to remove the server's HTTPS redirect.
Full vs Full (strict)
Full encrypts the connection but does not check the origin's certificate, so it would accept a certificate presented by anyone in the path. Treat it as a short-term step while you fix an expired or self-signed certificate. Full (strict) checks that the certificate is valid and matches the hostname. Cloudflare accepts either a publicly trusted certificate or a Cloudflare Origin CA certificate.
Origin CA certificates vs public certificates
| Public certificate (Let's Encrypt, AutoSSL, commercial CA) | Cloudflare Origin CA certificate | |
|---|---|---|
| Trusted by browsers | Yes | No, only by Cloudflare |
| Works with Full (strict) | Yes | Yes |
| Works if you pause Cloudflare or set a record to DNS-only | Yes | No, visitors get certificate warnings |
| Renewal | Usually automatic through your host or Certbot | You choose the validity period when you create it |
| Expiry alerts | Depends on your host | Cloudflare does not send expiration notices |
You create an Origin CA certificate from SSL/TLS > Origin Server with Create Certificate. Save the private key right away, because it is shown only once. Origin CA certificates cannot include IP addresses as names.
Our usual recommendation: if your host already issues free public certificates automatically (AutoSSL on cPanel, Let's Encrypt with Certbot), keep using them. Your site then works whether or not Cloudflare is in front of it. Use Origin CA when the server cannot get a public certificate, and put its expiry date on your calendar.
Settings that go with the mode
All of these live under SSL/TLS > Edge Certificates.
Always Use HTTPS
This setting redirects every HTTP request to HTTPS at Cloudflare's edge, for all hostnames in the zone. It is available on all plans. Cloudflare recommends doing the redirect here rather than on the origin, to avoid loops. Do not turn it on if parts of your site still cannot serve HTTPS. Use a targeted redirect rule for those parts instead. It also does not fix mixed content; pages that load images or scripts over http:// still need their links corrected.
HSTS: powerful, but hard to undo
HTTP Strict Transport Security tells browsers to use only HTTPS for your domain for a set period (the max-age, up to 12 months in Cloudflare's settings). Cloudflare's dashboard makes you acknowledge a warning before you enable it, and for good reason:
- If HTTPS stops working, visitors cannot reach your site for the length of the max-age. They cannot click past the error.
- includeSubDomains applies the rule to every subdomain. Any subdomain without HTTPS (an old intranet, a printer portal, a vendor-hosted page) becomes unreachable.
- Preload puts your domain into lists built into browsers. Cloudflare warns it can make a site without HTTPS completely inaccessible, and removal is slow.
Our approach: start with a short max-age, leave includeSubDomains off until you have checked every subdomain, and enable preload only after HTTPS has run cleanly for months.
Minimum TLS version
This setting rejects visitors whose software only supports older TLS versions. It is configurable at the zone level on all plans. Setting it to TLS 1.2 is a common baseline and blocks the deprecated TLS 1.0 and 1.1. Check first whether any old equipment or integration (an older card terminal or a legacy API client) still connects to that hostname.
Make sure attackers can't go around Cloudflare
The protections you set in Cloudflare only apply to traffic that goes through Cloudflare. If someone finds your server's real IP address, through old DNS history or a mail record on the same server, they can connect directly and skip your WAF and SSL settings. Cloudflare suggests two layers.
Authenticated Origin Pulls
With Authenticated Origin Pulls, Cloudflare presents a client certificate (mutual TLS) when it connects to your server, and your server rejects connections that do not have it. It is available on all plans and works only with Full or Full (strict), not Off or Flexible. Note the limitation Cloudflare documents: the global certificate is shared by all Cloudflare accounts, so it only proves the request came from Cloudflare's network, not from your account. Zone-level or per-hostname certificates that you upload are tied to your zone.
Allow only Cloudflare's IP ranges
Cloudflare publishes its IP ranges at cloudflare.com/ips and recommends blocking web traffic to your origin from any other source, with exceptions for trusted vendors. On a Linux server that means firewall rules allowing ports 80 and 443 only from those ranges, with your exceptions added before the final drop rule. The ranges change rarely, and Cloudflare adds new ones to the list before using them, but someone should still own the job of keeping the rule current. Our Linux server hardening guide covers firewall basics.
A quick checklist
- Valid certificate on the origin (public or Origin CA), with renewal or expiry tracked.
- Encryption mode set to Full (strict), and no hostnames left on Flexible through rules.
- Always Use HTTPS on, with no competing redirect loop on the server.
- HSTS enabled carefully, starting with a short max-age.
- Minimum TLS version set to 1.2 after checking for legacy clients.
- Origin locked down with Authenticated Origin Pulls and/or a firewall that allows only Cloudflare.
If you are not sure what mode your site is using, or you want the origin locked down properly, our cybersecurity and web hosting management teams can review it. Request a free IT assessment and we will check your Cloudflare and server setup for businesses across Miami-Dade and South Florida. We are an independent IT provider that configures Cloudflare for clients.
Sources
- Encryption modes (Cloudflare Docs)
- ERR_TOO_MANY_REDIRECTS (Cloudflare Docs)
- Cloudflare Origin CA (Cloudflare Docs)
- Always Use HTTPS (Cloudflare Docs)
- HTTP Strict Transport Security (Cloudflare Docs)
- Minimum TLS Version (Cloudflare Docs)
- Authenticated Origin Pulls (Cloudflare Docs)
- Cloudflare IP addresses (Cloudflare Docs)
