Cloudflare SSL/TLS: Flexible, Full or Strict, which to choose
Guide to choosing the Cloudflare SSL/TLS mode for your website: what Flexible, Full and Full (strict) do, and how to fix the too many redirects error.
You change your domain's encryption mode in Cloudflare to remove the “not secure” warning and, suddenly, the browser answers “this page redirected you too many times.” Your website went down just when a campaign was driving traffic. Almost always the culprit is the same badly chosen option.
What does Cloudflare's SSL/TLS mode do?
It defines whether the connection is encrypted on each of the two legs: from the visitor to Cloudflare and from Cloudflare to your server. With Cloudflare in the middle, your site does not have one connection but two, and each mode decides which ones it protects, according to Cloudflare's documentation.
That is why a green padlock in the browser does not guarantee the whole path is encrypted: that padlock only speaks for the first leg.
What is the difference between Flexible, Full and Full (strict)?
Flexible encrypts only the first leg, Full encrypts both without validating the certificate, and Full (strict) encrypts both and validates the certificate. This is how Cloudflare describes them:
| Mode | Visitor to Cloudflare | Cloudflare to your server |
|---|---|---|
| Off | No encryption | No encryption |
| Flexible | Can use HTTPS | Unencrypted (HTTP) |
| Full | Can use HTTPS | HTTPS without validating the certificate |
| Full (strict) | Can use HTTPS | HTTPS validating the certificate |
| Strict (SSL-Only Origin Pull) | Can use HTTPS | Always HTTPS, with a validated certificate |
The Full (strict) certificate can come from a public authority, such as Let’s Encrypt, or from Cloudflare’s Origin CA.
Which mode is right for me?
Use Full (strict) if your server has a valid certificate, and Full if the certificate is self-signed. Cloudflare strongly recommends Full or Full (strict) to prevent malicious connections to your origin server. Flexible is left for servers that do not support TLS, and the documentation itself advises improving that setup as soon as you can.
Cloudflare also offers automatic SSL/TLS, which picks the most secure mode your server supports and applies it gradually. Keep in mind: it does not downgrade to a less secure mode, so your certificate must stay valid.
Why does my website say “too many redirects”?
Almost always it is Flexible mode together with an HTTPS redirect on your server. Cloudflare explains it like this: in Flexible, Cloudflare connects to your server over HTTP, your server answers “go to HTTPS,” Cloudflare asks again over HTTP and the cycle never ends.
You have three ways out, according to the documentation:
- Remove the HTTPS redirect on your server.
- Switch to Full or Full (strict), which requires a certificate on the server.
- Force HTTPS from Cloudflare, with no redirects on the server.
Common mistake: turning on Always Use HTTPS in Cloudflare and also leaving an HTTPS redirect on your server. Cloudflare recommends not doing that redirect at the origin, because it can cause loops.
What does Always Use HTTPS do and not do?
It redirects all visits from http to https on all subdomains of your application. According to Cloudflare's documentation, it is available on the Free, Pro, Business and Enterprise plans, and the option does not appear if the encryption mode is Off. You turn it on under SSL/TLS, Edge Certificates.
Two limits worth knowing: it does not fix mixed content (images or scripts loaded over http inside an https page), and you should not turn it on if only part of your application supports HTTPS.
How do I set it up step by step?
Check the current mode, confirm your server has a valid certificate and switch to Full (strict). Before touching anything, open your site in a private window and note whether it loads fine. Then change the mode, reload and test the key pages again, including your campaign pages.
If you are building your infrastructure, see what the free Cloudflare plan includes, how to migrate from WordPress to Cloudflare Pages without losing SEO and what the HTTP security and cache headers control. And if you do not have a domain yet, check whether .co or .com suits you.
In short
Choose Full (strict) whenever your server has a valid certificate, and avoid Flexible unless you have no other option. That way you will not see your website down from a redirect loop right in the middle of a campaign. If you would rather have us set it up and test it, learn about our hosting and domains service.
Frequently asked questions
Which Cloudflare SSL/TLS mode should I use?
Cloudflare recommends Full or Full (strict) whenever possible, to prevent malicious connections to your origin server.
What is the difference between Full and Full (strict)?
In both, the leg to your server is encrypted, but only Full (strict) validates the origin certificate. Full accepts unvalidated certificates.
Why does my website show too many redirects?
According to Cloudflare, it happens in Flexible mode if your server redirects all HTTP traffic to HTTPS. Cloudflare connects over HTTP and the cycle repeats.
Does Always Use HTTPS fix mixed content?
No. Cloudflare clarifies that forcing HTTPS does not fix mixed content: pages must use relative links or HTTPS.
Do not stop at the theory: apply it to your business
We implement hosting and domains end to end, with your real operation. The first conversation is free.
