Is my Cloudflare SSL mode set wrong?

Updated 2026-10-16

Short answer: Cloudflare's SSL mode decides how it connects to your server. Flexible means the visitor's connection is encrypted but Cloudflare talks to your server unencrypted, and it causes redirect loops when the server also forces HTTPS. If your server has a valid certificate, Full (strict) is the safe setting.

How to check it yourself

  1. In the Cloudflare dashboard, open your domain, then SSL/TLS, then Overview, and note the mode.
  2. If it's Flexible and your server has a certificate, switch to Full (strict).
  3. If you get redirect loops, check that your server and Cloudflare aren't both redirecting.
  4. Also check Always Use HTTPS, the minimum TLS version, and that development mode isn't left on.

What Preventionlabs shows

With a read-only Cloudflare token connected, every report shows your Cloudflare settings: zone paused or inactive, SSL mode (Off, Flexible, Full or Full strict), Always Use HTTPS, development mode left on, minimum TLS version, automatic HTTPS rewrites and security level. For example, from a real report: SSL set to "Full" but not strict, so Cloudflare doesn't check the server's certificate; Always Use HTTPS off with no redirect of its own; and a minimum TLS version of 1.0, which RFC 8996 says "MUST NOT be used".

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free