HTTPS is essential for modern websites. It protects information travelling between a visitor’s browser and a website, helps establish trust and supports secure online transactions.<\/p>\n
However, when a website uses Cloudflare, HTTPS involves more than installing a certificate on the hosting server. Cloudflare sits between the visitor and the origin server, creating two separate connections that must be configured appropriately.<\/p>\n
If the SSL\/TLS settings are incorrect, a website may experience redirect loops, certificate errors or an insecure connection between Cloudflare and the origin server.<\/p>\n
Understanding the available SSL\/TLS modes helps website owners avoid these problems and make better use of Cloudflare’s security capabilities.<\/p>\n
When a website uses Cloudflare’s proxy, a visitor’s request normally passes through two connections.<\/p>\n
The first connection runs from the visitor’s browser to Cloudflare. The second runs from Cloudflare to the origin server hosting the website.<\/p>\n
Each connection has its own encryption requirements.<\/p>\n
A valid certificate at Cloudflare does not automatically mean the origin server is correctly configured. Similarly, installing an origin certificate does not guarantee that visitors will receive a valid HTTPS connection.<\/p>\n
Cloudflare’s SSL\/TLS encryption mode determines how Cloudflare connects to the origin server. Choosing the appropriate mode is important for both security and compatibility.<\/p>\n
Flexible SSL encrypts the connection between the visitor and Cloudflare, but the connection from Cloudflare to the origin server uses HTTP rather than HTTPS.<\/p>\n
This can be useful in limited situations where an origin server does not yet support HTTPS. However, it leaves the connection between Cloudflare and the origin server unencrypted.<\/p>\n
For websites handling customer information, login credentials or sensitive transactions, that limitation is significant.<\/p>\n
Flexible mode can also contribute to redirect loops if the origin server repeatedly redirects HTTP requests to HTTPS without correctly recognising the original visitor connection.<\/p>\n
For these reasons, Flexible should not be treated as the preferred long-term configuration for a business website.<\/p>\n
Full mode encrypts both connections: the visitor-to-Cloudflare connection and the Cloudflare-to-origin connection.<\/p>\n
Unlike Full (Strict), Full does not require the origin server’s certificate to be trusted and valid in the same way. This means a certificate problem at the origin may not prevent Cloudflare from establishing the encrypted connection.<\/p>\n
Although Full provides encryption between Cloudflare and the origin, website owners should still ensure that the origin certificate is correctly configured.<\/p>\n
Encryption alone does not establish that the origin certificate has been properly validated.<\/p>\n
Full (Strict) encrypts both connections and requires the origin server to present a certificate that Cloudflare can validate.<\/p>\n
This generally means using a valid certificate from a trusted certificate authority or an appropriate Cloudflare Origin CA certificate, subject to Cloudflare’s requirements.<\/p>\n
For most properly configured production websites, Full (Strict) is the preferred option because it combines encryption with origin certificate validation.<\/p>\n
Before switching modes, verify that the origin server has a suitable certificate installed and that it is valid for the hostname Cloudflare connects to.<\/p>\n
Changing to Full (Strict) without checking the origin certificate can cause Cloudflare to reject the origin connection and return an error.<\/p>\n
The appropriate mode depends on the website’s origin configuration, but the following comparison provides a useful starting point.<\/p>\n
| Mode<\/th>\n | Browser to Cloudflare<\/th>\n | Cloudflare to origin<\/th>\n | Typical consideration<\/th>\n<\/tr>\n |
|---|---|---|---|
| Flexible<\/td>\n | Encrypted<\/td>\n | Unencrypted<\/td>\n | Limited use cases; origin traffic is not encrypted<\/td>\n<\/tr>\n |
| Full<\/td>\n | Encrypted<\/td>\n | Encrypted<\/td>\n | Origin certificate validation is less strict<\/td>\n<\/tr>\n |
| Full (Strict)<\/td>\n | Encrypted<\/td>\n | Encrypted and validated<\/td>\n | Preferred for properly configured production websites<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n For most business websites, the goal should be to configure a valid origin certificate and use Full (Strict).<\/p>\n Do not change the mode blindly if the website is already experiencing an error. First identify whether the problem is related to certificate validity, server configuration, redirect rules or another issue.<\/p>\n How Incorrect SSL Settings Cause Redirect Loops<\/h2>\nA redirect loop occurs when a browser is repeatedly redirected between URLs or protocols without reaching the intended page.<\/p>\n One possible cause involves Flexible SSL. Cloudflare may receive an HTTPS request from a visitor but communicate with the origin server over HTTP. If the origin server then redirects that request to HTTPS, the resulting behaviour can create a loop depending on the server and application configuration.<\/p>\n Other causes include conflicting WordPress settings, reverse-proxy configuration, server-level redirects and duplicate rules.<\/p>\n If your website enters a redirect loop, review the Cloudflare encryption mode alongside the origin server’s HTTPS settings. Check that WordPress recognises the correct site URL and that the server handles forwarded HTTPS requests appropriately.<\/p>\n Avoid adding more redirect rules until you understand which layer is creating the loop.<\/p>\n How to Troubleshoot Cloudflare SSL Errors<\/h2>\nIf a website displays an SSL-related Cloudflare error, begin by identifying the error code and determining whether the problem occurs between the visitor and Cloudflare or between Cloudflare and the origin server.<\/p>\n Check the origin certificate’s validity, hostname coverage and expiry date. Confirm that the web server is configured to serve the correct certificate and that the origin is reachable through the expected route.<\/p>\n Next, review the current SSL\/TLS mode and any recent changes to DNS, hosting or certificate configuration.<\/p>\n If the error began after switching to Full (Strict), verify that the origin certificate meets the requirements before making further changes.<\/p>\n Testing changes in a controlled manner is safer than repeatedly switching between modes without identifying the underlying issue.<\/p>\n Does Cloudflare Pro Automatically Fix SSL Problems?<\/h2>\nNo. Cloudflare Pro includes additional website security and performance capabilities, but purchasing a paid plan does not automatically correct every certificate, redirect or origin-server configuration problem.<\/p>\n SSL\/TLS settings still need to match the website’s infrastructure.<\/p>\n A business website with a valid origin certificate can generally use a stronger configuration than a site whose origin has not been prepared for HTTPS. The correct approach is to fix the underlying certificate and server settings rather than rely on a weaker mode indefinitely.<\/p>\n Website owners should also monitor certificate expiry, verify DNS records and test the complete HTTPS journey after configuration changes.<\/p>\n Explore Cloudflare Pro Through Tremhost<\/h2>\nBusinesses looking to improve website security and performance can explore Tremhost’s Cloudflare offering.<\/p>\n Tremhost offers a Cloudflare Pro-based security option from $9 per month<\/strong>. Visit the Tremhost Cloudflare page<\/a> to review the available service details.<\/p>\n Before choosing a provider, confirm what is included in the service and whether SSL\/TLS configuration assistance is part of the package.<\/p>\n For broader assistance with protecting online infrastructure, businesses can also explore Tremhost’s managed cybersecurity services<\/a>.<\/p>\n Cloudflare’s SSL\/TLS modes determine how encrypted connections are established between visitors, Cloudflare and the origin server.<\/p>\n Flexible encrypts only the visitor-to-Cloudflare connection. Full encrypts both connections but applies less stringent origin certificate validation. Full (Strict) encrypts both connections and validates the origin certificate.<\/p>\n For most properly configured production websites, Full (Strict) is the preferred choice. However, it should be enabled only after confirming that the origin certificate and server configuration are correct.<\/p>\n Understanding these differences helps website owners avoid common HTTPS problems while maintaining a stronger security configuration.<\/p>\n |