“Our site has SSL” is a phrase that gets treated as a single, binary fact — either you have it or you don’t — when in reality, SSL configuration has several distinct modes, and the difference between them is the difference between genuinely secure and only appearing secure. Here’s what actually separates basic SSL from Full (Strict) mode, and why the distinction is worth understanding rather than assuming your host handled it correctly by default.
The Padlock Icon Doesn’t Tell You What You Think It Does
Most people’s mental model of website security starts and ends with the padlock icon in the browser bar — if it’s there, the site is “secure.” What the padlock actually confirms is narrower: that the connection between the visitor’s browser and whatever server responded is encrypted. It doesn’t tell you whether that encryption extends all the way to your actual origin server, or stops partway.
The Different SSL Modes, Explained
When a proxy service like Cloudflare sits in front of your site, there are actually several distinct ways the connection between Cloudflare and your origin server can be configured:
- Off — no encryption at all between visitor and site. Rare today, but still the weakest possible state.
- Flexible — the connection between the visitor and Cloudflare is encrypted, but the connection between Cloudflare and your actual origin server is not. The visitor sees a padlock, but the final leg of the journey is unencrypted.
- Full — the connection is encrypted the entire way, visitor to Cloudflare to origin, but the certificate on your origin server isn’t strictly validated — meaning even a self-signed or invalid certificate is accepted.
- Full (Strict) — the connection is encrypted the entire way, and the origin server’s certificate must be valid and properly verified. This is the mode that actually confirms the server Cloudflare is talking to is genuinely yours, not something impersonating it.
Why “Flexible” Is More Common Than It Should Be
Flexible mode is often the default a lot of hosting setups fall into, because it’s the easiest to configure — it doesn’t require setting up a valid certificate on the origin server itself. The problem is that it creates a real gap: the visitor’s browser shows a secure padlock, creating a false sense of complete protection, while the actual connection from Cloudflare to your server is sent in plain text. Anyone able to intercept that final leg — a compromised network, a misconfigured server, certain man-in-the-middle scenarios — can read that traffic, despite the visitor-facing padlock suggesting everything is protected.
Why Full (Strict) Is the Meaningful Standard
Full (Strict) mode closes this gap in two ways: the entire path is encrypted, and the origin certificate is actually validated rather than blindly trusted. This second part matters more than it sounds — without strict validation, there’s theoretically nothing stopping traffic from being redirected to a server presenting a fake or self-signed certificate that gets accepted anyway, since “Full” mode alone doesn’t check whether the certificate is genuinely trustworthy.
What This Looks Like Practically
| Mode | Visitor-to-Proxy Encrypted | Proxy-to-Origin Encrypted | Origin Certificate Verified |
|---|---|---|---|
| Off | No | No | N/A |
| Flexible | Yes | No | N/A |
| Full | Yes | Yes | No |
| Full (Strict) | Yes | Yes | Yes |
How to Tell Which Mode Your Site Is Actually Running
This isn’t visible from the visitor side — the padlock icon looks identical in Flexible and Full (Strict) modes, which is exactly why so many site owners assume they’re fully protected when they’re not. Checking this requires looking at the actual proxy/DNS configuration directly, not just observing the browser’s padlock icon.
Why This Is Worth Getting Right, Not Just “Set Once and Forget”
An origin server’s SSL certificate can expire, get misconfigured during a server migration, or be overlooked entirely when a site is initially set up quickly. If Full (Strict) mode was never properly configured — or was set up once but the certificate later expired without anyone noticing — the site can silently drop back to a weaker effective state without any visible warning to visitors, who continue seeing the same reassuring padlock regardless.
Where This Fits Into Tremhost’s Setup
This is precisely why Universal SSL configured to Full (Strict) mode, with a proper origin certificate, is included as a baseline part of Armor Lite rather than treated as an optional upgrade — it’s foundational, not a premium add-on, because the alternative (Flexible mode) creates a security gap that isn’t visible to anyone just checking for the padlock.
