How Cloudflare SSL modes work
Choosing the right Cloudflare SSL mode determines how encrypted traffic moves between a visitor, Cloudflare, and your origin server.
The best setting depends on whether your origin already supports HTTPS, whether you can install a certificate, and how much trust you want to place on the connection behind Cloudflare’s edge.
Cloudflare acts as a reverse proxy, so the browser connects to Cloudflare first.
From there, Cloudflare either forwards traffic to your origin over HTTP or HTTPS, depending on the SSL/TLS mode you select in the Cloudflare dashboard.
What are the available Cloudflare SSL modes?
Cloudflare provides four main SSL/TLS encryption modes.
Each one offers a different balance of compatibility, security, and setup effort.
- Off — No encryption between Cloudflare and your origin.
Browsers may still use HTTPS at the edge, but origin traffic is not encrypted.
- Flexible — Encryption exists only between the browser and Cloudflare.
Cloudflare connects to the origin over HTTP.
- Full — Encryption is used from the browser to Cloudflare and from Cloudflare to the origin, but Cloudflare does not verify the origin certificate.
- Full (strict) — End-to-end encryption with certificate validation at the origin.
Cloudflare requires a valid certificate, such as one from a public CA or a Cloudflare Origin CA certificate.
For most modern websites, Full (strict) is the preferred option because it provides encryption plus certificate validation, reducing the risk of misconfiguration and downgrade problems.
How to choose Cloudflare SSL mode for your site?
The right answer depends on your origin server’s HTTPS readiness.
If your web server already has a valid certificate and supports HTTPS correctly, Full (strict) is usually the best choice.
If your origin certificate is self-signed or not yet trusted publicly, Full may work temporarily, but Full (strict) is still the better long-term target.
If your origin cannot support HTTPS at all, Flexible may seem like a quick fix, but it is generally not recommended.
Flexible creates an encrypted connection only up to Cloudflare, leaving the origin hop unencrypted.
That can cause security gaps and even redirect loops if your site forces HTTPS incorrectly.
If you are migrating an older site, start by checking what your origin already supports:
- Does the server listen on port 443?
- Is there a valid certificate installed?
- Does the certificate match the hostname visitors use?
- Can the origin renew certificates automatically?
These checks usually reveal whether you can move directly to Full (strict) or need an interim configuration.
When should you use Full (strict)?
Use Full (strict) when your origin server has a valid certificate and you want the strongest practical setup in Cloudflare.
This mode is ideal for WordPress sites, ecommerce stores, SaaS applications, and any site that handles logins, forms, payments, or personal data.
Full (strict) is also the best fit when you use:
- Cloudflare Origin CA certificates
- Let’s Encrypt certificates
- Certificates from a trusted public certificate authority
Because Cloudflare validates the certificate on the origin, Full (strict) helps confirm that encrypted traffic is actually reaching the expected server rather than an impostor endpoint.
When is Full enough?
Full can be useful when your origin certificate is present but not publicly trusted, such as during testing or a short migration window.
Cloudflare will still encrypt traffic to the origin, but it will not check whether the certificate chain is valid or whether the hostname matches perfectly.
This mode is better than Flexible because it keeps the connection encrypted on both legs.
However, it should usually be treated as temporary.
If you can install a proper origin certificate, move to Full (strict) as soon as possible.
Why Flexible is usually a poor choice?
Flexible SSL is one of the most misunderstood Cloudflare settings.
It can make a site appear secure in the browser, but the connection from Cloudflare to the origin remains plain HTTP.
That means anyone between Cloudflare and your server can potentially observe or interfere with that traffic.
Flexible can also create operational problems.
If your origin redirects HTTP to HTTPS while Cloudflare is set to Flexible, the server may keep redirecting the request back to HTTPS, causing a loop.
This often shows up as an error page or repeated redirects that make the site unreachable.
For that reason, Flexible is generally only appropriate for legacy systems that cannot support HTTPS and are in a temporary transition state.
How to check your origin before changing the mode?
A careful origin review prevents downtime.
Before changing Cloudflare SSL mode, verify the following:
- Certificate status — Ensure the certificate is valid and not expired.
- Hostname coverage — Confirm the certificate covers the exact domain or subdomain.
- Server configuration — Check Apache, Nginx, LiteSpeed, or your hosting panel for HTTPS support.
- Firewall rules — Allow Cloudflare IP ranges if your origin restricts access.
- Redirect behavior — Review HTTP-to-HTTPS redirects to avoid loops.
If you manage your own server, tools like OpenSSL, cURL, and SSL Labs can help inspect certificate chain issues, cipher support, and TLS version compatibility.
What is the safest migration path?
The safest migration path is usually to move from HTTP-only hosting to Full (strict) in stages.
First, install a valid certificate on the origin.
Next, test HTTPS directly against the origin server before enabling it through Cloudflare.
Finally, switch the Cloudflare SSL mode to Full (strict) and confirm that pages load normally.
If you use Cloudflare Origin CA certificates, remember that they are trusted by Cloudflare but not by browsers directly.
That is fine because browsers connect to Cloudflare’s edge, while Cloudflare validates the origin connection.
This setup is common for reverse-proxy deployments.
For WordPress, update the site URL and ensure plugin or theme redirects do not conflict with the proxy.
For ecommerce platforms, test checkout flows, account pages, and webhook endpoints after the change.
Common mistakes when choosing Cloudflare SSL mode
Several recurring issues appear when site owners decide how to choose Cloudflare SSL mode:
- Using Flexible with forced HTTPS — Often causes redirect loops.
- Enabling Full without a valid certificate — Creates encryption but may hide certificate problems.
- Forgetting subdomains — A certificate may cover the main domain but not www or api subdomains.
- Not renewing origin certificates — Expired certificates can break Full (strict).
- Ignoring mixed content — Pages may still load insecure assets even when SSL is enabled.
These problems are avoidable if you test each hostname and verify that all assets, APIs, and redirects align with the chosen mode.
How to troubleshoot SSL errors after changing the mode?
If a site stops loading after you change Cloudflare settings, check the error message first.
Common Cloudflare errors such as 525, 526, or redirect loops usually point to certificate or origin configuration problems.
- 525 SSL handshake failed — The origin is not completing the TLS handshake.
- 526 Invalid SSL certificate — Cloudflare cannot validate the origin certificate in Full (strict).
- Redirect loop — HTTPS rules conflict between Cloudflare and the origin server.
Start by testing the origin directly, bypassing Cloudflare if possible.
Then review certificate validity, SNI configuration, and server logs.
In many cases, reinstalling the certificate or fixing the hostname resolves the issue quickly.
Which SSL mode is best for SEO and performance?
From an SEO perspective, HTTPS is the priority, not a specific Cloudflare mode by itself.
Search engines like Google favor secure sites, and modern browsers warn users away from insecure pages.
The best SSL mode is the one that keeps your site stable, secure, and accessible while preserving HTTPS end to end.
From a performance perspective, Cloudflare’s edge can still improve load times regardless of the mode, but Full (strict) usually gives the cleanest setup for caching, redirects, and long-term maintenance.
It also reduces the chance of security warnings that can hurt trust and engagement.
Quick decision guide
If you need a simple rule for how to choose Cloudflare SSL mode, use this:
- Choose Full (strict) if your origin has a valid certificate.
- Choose Full only if you are temporarily using an untrusted origin certificate.
- Avoid Flexible unless you have no HTTPS support on the origin and need a short-term workaround.
- Avoid Off unless you are intentionally disabling origin encryption for a very specific reason.
For most sites, the best practice is to install an origin certificate, verify HTTPS directly on the server, and run Cloudflare in Full (strict).
That gives you encryption, validation, and the least surprise during future maintenance.