Use Full (strict). It encrypts the Cloudflare-to-origin hop and validates your origin certificate. Flexible sends plaintext to your origin and is the most common cause of redirect loops. Most zones now choose the mode automatically.
The padlock in a visitor’s browser is not a statement about your server. It only says the browser reached Cloudflare over HTTPS. What happens on the next leg — from Cloudflare to the machine that actually holds your site — is a separate connection with separate rules, and the SSL/TLS encryption mode is the setting that governs it.
There are two connections, not one
Every proxied request is two hops. The first is secured by the edge certificate Cloudflare issues and renews for you; there is nothing to choose there. The second is the one the encryption mode controls: whether Cloudflare speaks HTTP or HTTPS to your origin, and how carefully it inspects the certificate your origin presents.
This is also why the setting is invisible on some records. It only takes effect where Cloudflare is in the path at all — a DNS-only record hands out your server’s real address and the browser connects directly, so there is no second hop for the mode to govern. If that distinction is new, start with what the orange cloud means in Cloudflare.
The five modes, side by side
| Mode | Visitor → Cloudflare | Cloudflare → origin | Origin certificate checked | Choose it when |
|---|---|---|---|---|
| Off | Cleartext — HTTPS is redirected down to HTTP | Cleartext | No | Never, in practice |
| Flexible | Encrypted | Cleartext | No | Your origin genuinely cannot serve TLS |
| Full | Encrypted | Matches the visitor’s scheme | No | The origin has a certificate, but not a valid public one |
| Full (strict) | Encrypted | Matches the visitor’s scheme | Yes | The default target for almost everyone |
| Strict (SSL-Only Origin Pull) | Either | Always encrypted | Yes | Enterprise zones wanting the strongest option |
Two rows deserve a second look. Full encrypts, but accepts whatever certificate the origin offers — expired, self-signed, issued for a different hostname, all fine. That stops passive eavesdropping and nothing else: an attacker positioned between Cloudflare and your origin can present their own certificate and be believed. Full (strict) is the same connection with the certificate actually verified, which is the difference between encryption and authenticated encryption.
The last row is easy to miss because it is Enterprise-only. Unlike Full and Full (strict), which mirror whatever scheme the visitor used, it connects to the origin over HTTPS even when the visitor arrived over plain HTTP.
The choice may already have been made for you
Cloudflare has been rolling out Automatic SSL/TLS, and it is the default for zones that have been migrated. Instead of a fixed setting, a crawler using the Cloudflare-SSLDetector user agent fetches your site over both HTTP and HTTPS, compares the responses, and picks the most secure mode your origin can actually support. Zones that have not been migrated still show only the manual list.
Four properties of that system are worth knowing before you go looking for the dropdown:
- It never moves you to something less secure. If your origin certificate expires, a zone on Full (strict) is not quietly demoted to Full — it stays put and starts failing, which is the correct behaviour but means you still have to keep the certificate valid.
- Upgrades ramp, they do not flip. A new mode starts on 1% of traffic and climbs in 10% steps. If origin connectivity breaks on the way up, Cloudflare aborts and rolls back. Moves from Flexible to Full or stricter go slower still, because changing the origin scheme changes cache keys and the cache needs to warm.
- Scans are roughly monthly, and stop once the zone is already on the most secure mode available or you have switched to Custom SSL/TLS.
- Notifications go to Super Admins only, as a weekly digest of upgraded zones. If your account’s admin address is not one you read, upgrades will look like they came from nowhere.
To take manual control, switch the zone to Custom SSL/TLS — in the API that is the ssl_automatic_mode zone setting set to custom. The mode itself remains the ssl setting, with values off, flexible, full, strict, and origin_pull. Note the naming trap: strict is Full (strict), while the Enterprise SSL-only mode is origin_pull.
Why Flexible causes so much trouble
Flexible is popular because it makes a padlock appear without touching the server. The costs show up later.
- Redirect loops. Cloudflare requests your origin over HTTP. Most modern stacks redirect all HTTP to HTTPS. Cloudflare follows that redirect back to itself, downgrades it to HTTP again, and the browser reports ERR_TOO_MANY_REDIRECTS. The fix is to remove the origin’s HTTPS redirect or move to Full — not to add another rule.
- Port 443 only. Flexible applies to HTTPS on the default port. HTTPS on any other port falls back to Full behaviour, so a site served on a non-standard port can behave differently from the rest of the zone for reasons nothing in the dashboard explains.
- Authenticated Origin Pulls is unavailable. It does not work under Flexible or Off, which rules out the standard way of proving to your origin that a request really came from Cloudflare.
- The traffic is readable. Anything between Cloudflare and your origin — hosting network, transit provider, anyone who has got in the middle — sees session cookies and form posts in cleartext.
Which error means which mode
The failure tells you where to look, and the mapping is tight:
| What you see | Mode in play | What it actually means |
|---|---|---|
| Error 525 | Full or Full (strict) | The TLS handshake with your origin failed: no certificate, port 443 closed, missing SNI support, or no shared cipher suite |
| Error 526 | Full (strict) | A certificate was presented but rejected — expired, revoked, self-signed, incomplete chain, or the hostname does not match |
| ERR_TOO_MANY_REDIRECTS | Flexible | Your origin redirects HTTP to HTTPS while Cloudflare insists on HTTP |
| ERR_TOO_MANY_REDIRECTS | Full or Full (strict) | The mirror image: your origin redirects HTTPS down to HTTP |
Treat 526 as a certificate problem, not a reason to downgrade. Dropping to Full does clear the error, and it clears it by no longer checking — the misconfiguration is still there, just silent. An incomplete chain is a common culprit: your origin must serve the intermediate certificates alongside the leaf, or Cloudflare cannot build a path to a trusted root even though the certificate itself is fine.
Moving to Full (strict) without an outage
- Put a certificate on the origin. A Cloudflare Origin CA certificate is free, lasts for years, and is trusted by Cloudflare specifically — it is not publicly trusted, which is fine, because only Cloudflare ever validates it.
- Confirm the origin answers on port 443, presents the full chain, and that the certificate’s name covers the hostname being requested.
- Remove any HTTP-to-HTTPS redirect at the origin. Cloudflare handles the visitor-facing redirect; leaving one at the origin is what creates loops after the switch.
- Switch to Full (strict) and watch for 525 and 526 in your analytics. Both are origin-side failures, so the answer is always on the server, not in the dashboard.
- If only one hostname needs a different mode, use a configuration rule rather than moving the whole zone.
One caveat when a hostname is served through a SaaS platform on Cloudflare: your zone is not the only one applying settings, and the encryption mode you can see may not be the one deciding the final hop. That situation has its own rules, covered here.
Modes change and their behaviour is occasionally revised; before relying on a specific row above, check the official encryption modes reference.
FAQ
What is the difference between Flexible and Full in Cloudflare?
Flexible sends requests to your origin over plain HTTP, so the second half of the journey is unencrypted and no origin certificate is needed. Full connects to the origin using the same scheme the visitor used, so an HTTPS request stays encrypted end to end — but the origin’s certificate is not checked.
Is Cloudflare Flexible SSL secure?
Only partially. Visitors see a valid padlock because the visitor-to-Cloudflare connection is encrypted, but traffic between Cloudflare and your origin travels in cleartext and can be read or modified in transit. Cloudflare advises against it for anything carrying logins or personal data.
Why does Cloudflare say ERR_TOO_MANY_REDIRECTS?
Usually because your encryption mode and your origin disagree about which scheme to use. On Flexible, Cloudflare requests HTTP and an origin that redirects all HTTP to HTTPS sends the request straight back, and the loop repeats until the browser gives up.
What is the difference between Full and Full (strict)?
Both encrypt the connection to your origin. Full accepts any certificate the origin presents, including expired, self-signed, or wrong-hostname ones. Full (strict) requires an unexpired certificate from a publicly trusted CA or Cloudflare Origin CA whose name matches the hostname.
Do I still need an SSL certificate on my origin if I use Cloudflare?
For every mode except Off and Flexible, yes. Cloudflare issues the certificate visitors see, but the connection from Cloudflare to your server needs its own certificate — a free Cloudflare Origin CA certificate satisfies Full (strict) and never has to be publicly trusted.