“Our site has SSL” is a phrase that gets treated as a single, binary fact \u2014 either you have it or you don’t \u2014 when in reality, SSL configuration has several distinct modes, and the difference between them is the difference between genuinely secure and only appearing secure. Here’s what actually separates basic SSL from Full (Strict) mode, and why the distinction is worth understanding rather than assuming your host handled it correctly by default.<\/p>\n
Most people’s mental model of website security starts and ends with the padlock icon in the browser bar \u2014 if it’s there, the site is “secure.” What the padlock actually confirms is narrower: that the connection between the visitor’s browser and whatever server responded<\/em> is encrypted. It doesn’t tell you whether that encryption extends all the way to your actual origin server, or stops partway.<\/p>\n When a proxy service like Cloudflare sits in front of your site, there are actually several distinct ways the connection between Cloudflare and your origin server can be configured:<\/p>\n Flexible mode is often the default a lot of hosting setups fall into, because it’s the easiest to configure \u2014 it doesn’t require setting up a valid certificate on the origin server itself. The problem is that it creates a real gap: the visitor’s browser shows a secure padlock, creating a false sense of complete protection, while the actual connection from Cloudflare to your server is sent in plain text. Anyone able to intercept that final leg \u2014 a compromised network, a misconfigured server, certain man-in-the-middle scenarios \u2014 can read that traffic, despite the visitor-facing padlock suggesting everything is protected.<\/p>\n Full (Strict) mode closes this gap in two ways: the entire path is encrypted, and the origin certificate is actually validated rather than blindly trusted. This second part matters more than it sounds \u2014 without strict validation, there’s theoretically nothing stopping traffic from being redirected to a server presenting a fake or self-signed certificate that gets accepted anyway, since “Full” mode alone doesn’t check whether the certificate is genuinely trustworthy.<\/p>\n This isn’t visible from the visitor side \u2014 the padlock icon looks identical in Flexible and Full (Strict) modes, which is exactly why so many site owners assume they’re fully protected when they’re not. Checking this requires looking at the actual proxy\/DNS configuration directly, not just observing the browser’s padlock icon.<\/p>\n An origin server’s SSL certificate can expire, get misconfigured during a server migration, or be overlooked entirely when a site is initially set up quickly. If Full (Strict) mode was never properly configured \u2014 or was set up once but the certificate later expired without anyone noticing \u2014 the site can silently drop back to a weaker effective state without any visible warning to visitors, who continue seeing the same reassuring padlock regardless.<\/p>\n This is precisely why Universal SSL configured to Full (Strict) mode, with a proper origin certificate<\/strong>, is included as a baseline part of Armor Lite<\/strong> rather than treated as an optional upgrade \u2014 it’s foundational, not a premium add-on, because the alternative (Flexible mode) creates a security gap that isn’t visible to anyone just checking for the padlock.<\/p>\n","protected":false},"excerpt":{"rendered":" “Our site has SSL” is a phrase that gets treated as a single, binary fact \u2014 either you have it or you don’t \u2014 when in reality, SSL configuration has several distinct modes, and the difference between them is the difference between genuinely secure and only appearing secure. Here’s what actually separates basic SSL from […]<\/p>\n","protected":false},"author":226,"featured_media":40099,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[49],"tags":[],"class_list":["post-77094","post","type-post","status-publish","format-standard","has-post-thumbnail","category-tips"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tThe Different SSL Modes, Explained<\/h3>\n
\n
Why “Flexible” Is More Common Than It Should Be<\/h3>\n
Why Full (Strict) Is the Meaningful Standard<\/h3>\n
What This Looks Like Practically<\/h3>\n
\n\n
\n \nMode<\/th>\n Visitor-to-Proxy Encrypted<\/th>\n Proxy-to-Origin Encrypted<\/th>\n Origin Certificate Verified<\/th>\n<\/tr>\n<\/thead>\n \n Off<\/td>\n No<\/td>\n No<\/td>\n N\/A<\/td>\n<\/tr>\n \n Flexible<\/td>\n Yes<\/td>\n No<\/td>\n N\/A<\/td>\n<\/tr>\n \n Full<\/td>\n Yes<\/td>\n Yes<\/td>\n No<\/td>\n<\/tr>\n \n Full (Strict)<\/td>\n Yes<\/td>\n Yes<\/td>\n Yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n How to Tell Which Mode Your Site Is Actually Running<\/h3>\n
Why This Is Worth Getting Right, Not Just “Set Once and Forget”<\/h3>\n
Where This Fits Into Tremhost’s Setup<\/h3>\n