Enforce HTTPS và encrypt all traffic (Free, Pro, và Business) Enforce HTTPS and encrypt all traffic (Free, Pro, and Business)

1. In the Cloudflare dashboard, go to the SSL/TLS Overview page.

Go to Overview

1. Check the current encryption mode displayed on the page.

If the mode is already Full (strict), skip to Redirect all HTTP requests to HTTPS. If the mode is not Full (strict), continue below to install an origin certificate (if needed) and change the mode.

If your origin server does not have a valid SSL certificate, install a free Cloudflare Origin CA certificate. Origin CA certificates are valid for up to 15 years and are trusted by Cloudflare, which means you can set your encryption mode to Full (strict) after installing one.

If your origin already has a valid certificate from a publicly trusted certificate authority, skip to Set your encryption mode to Full (strict).

1. Go to the Origin Server page.

Go to Origin Server

1. On the Origin Certificates tab, select Create Certificate.
2. Choose either:

Generate private key and CSR with Cloudflare: Private key type can be RSA or ECC. Use my private key and CSR: Paste your Certificate Signing Request (CSR) into the text field.

1. List the hostnames (including wildcards) the certificate should protect with SSL encryption. The zone apex and first level wildcard hostname are included by default.
2. Choose a Certificate Validity period.
3. Select Create.
4. Choose the Key Format:

Servers using OpenSSL (such as Apache and NGINX) generally expect PEM files (Base64-encoded ASCII), but also work with binary DER files. Servers using Windows and Apache Tomcat require PKCS#7 (a .p7b file).

1. Copy the signed Origin Certificate and Private Key into separate files. For security reasons, you cannot see the Private Key after you exit this screen.
2. Select OK.

For details about working with certificates programmatically, refer to API calls.

1. Upload the Origin CA certificate to your origin web server.
2. Update your web server configuration to use the certificate. For server-specific installation instructions, refer to Origin CA certificates.
3. (Required for some servers) Upload the Cloudflare CA root certificate to your origin server.
4. Enable SSL and port 443 at your origin web server.

If you do not see your server listed, search the DigiCert documentation ↗ or contact your hosting provider.

After installing a valid certificate on your origin server, set the encryption mode to Full (strict) by following the steps below.

• Dashboard
• API

To change your encryption mode in the dashboard:

1. In the Cloudflare dashboard, go to the SSL/TLS Overview page.

Go to Overview

1. Choose an encryption mode.

To adjust your encryption mode with the API, send a PATCH request with ssl as the setting name in the URI path, and the value parameter set to your desired setting (off, flexible, full, strict, or origin_pull).

Warning

If your site shows a 526 error after changing the encryption mode, your origin certificate may not meet the requirements for Full (strict). The certificate must be unexpired, issued by a trusted CA or Cloudflare Origin CA, and contain a Common Name (CN) or Subject Alternative Name (SAN) that matches your hostname. For redirect loop issues, refer to ERR\TOO\MANY\_REDIRECTS.

Always Use HTTPS redirects all HTTP requests to HTTPS before they reach your origin.

If only some parts of your application can support HTTPS traffic, do not turn on Always Use HTTPS. Use a single redirect to selectively redirect specific paths to HTTPS instead. Refer to Redirect admin area requests to HTTPS for an example.

• Dashboard
• API

1. In the Cloudflare dashboard, go to the SSL/TLS Overview page.

Go to Overview

1. Make sure that your SSL/TLS encryption mode is not set to Off. When the encryption mode is Off, the Always Use HTTPS option is not visible in the dashboard.
2. Go to the Edge Certificates ↗ page.
3. Turn on Always Use HTTPS.

1. Make sure that your SSL/TLS encryption mode is not set to Off.
2. Send a PATCH request with alwaysusehttps as the setting name in the URI path, and the value parameter set to "on".

Automatic HTTPS Rewrites prevents mixed content errors by rewriting HTTP resource URLs in your page HTML to HTTPS. This is useful for sites where you do not control all asset URLs, such as CMS-hosted content or embedded third-party resources.

• Dashboard
• API

1. In the Cloudflare dashboard, go to the Edge Certificates page.

Go to Edge Certificates

1. For Automatic HTTPS Rewrites, switch the toggle to On.

Send a PATCH request with automatichttpsrewrites as the setting name in the URI path, and the value parameter set to "on".

Automatic HTTPS Rewrites does not rewrite all HTTP URLs. Some passive content (such as images) may not be rewritten, which can still cause mixed content warnings. For details on how rewrites work and troubleshooting, refer to Automatic HTTPS Rewrites and Mixed content errors.

TLS 1.0 and 1.1 have known vulnerabilities and are no longer considered secure. Setting the minimum TLS version to 1.2 blocks connections from clients using older protocols. For guidance on which version to choose, refer to TLS protocols.

• Dashboard
• API

1. In the Cloudflare dashboard, go to the Edge Certificates page.

Go to Edge Certificates

1. For Minimum TLS Version, select TLS 1.2.

Send a PATCH request with mintlsversion as the setting name in the URI path, and the value parameter set to "1.2".

Per-hostname minimum TLS version requires Advanced Certificate Manager

To set minimum TLS versions for individual hostnames instead of the entire zone, refer to Per-hostname setup. This requires an Advanced Certificate Manager subscription.

TLS 1.3 provides faster handshakes and improved security over TLS 1.2.

• Dashboard
• API

1. In the Cloudflare dashboard, go to the Edge Certificates page.

Go to Edge Certificates

1. For TLS 1.3, switch the toggle to On.

Send a PATCH request with tls13 as the setting name in the URI path, and the value parameter set to "on". To also turn on 0-RTT (Zero Round Trip Time Resumption), set the value to "zrt".

HTTP Strict Transport Security (HSTS) adds a response header that tells browsers to connect to your site over HTTPS only, even if a link or redirect tries to send them over HTTP. HSTS protects against protocol downgrade attacks.

Warning

Only turn on HSTS after your HTTPS configuration is fully working and tested. If you remove HTTPS before disabling HSTS or before waiting for the duration of the original Max Age Header, your website becomes inaccessible to visitors for the Max Age Header duration or until you re-enable HTTPS. Refer to HTTP Strict Transport Security (HSTS) before configuring.

Before turning on HSTS, confirm these prerequisites:

• HTTPS is enabled and working on your domain.
• Your DNS records are set to Proxied.
• You are not redirecting HTTPS to HTTP anywhere.

• Dashboard
• API

1. In the Cloudflare dashboard, go to the Edge Certificates page.

Go to Edge Certificates

1. For HTTP Strict Transport Security (HSTS), select Enable HSTS.
2. Read the dialog and select I understand.
3. Select Next.
4. Configure the HSTS settings:

Max Age Header: Choose a duration (start with 6 months, increase to 12 months after confirming stability). Apply HSTS policy to subdomains (includeSubDomains): Turn on if all your subdomains support HTTPS. Subdomains without HTTPS become inaccessible when this is enabled. Preload: Turn on only after setting Max Age Header to 12 months. Preload inclusion prevents downgrade attacks on the first visit. Submit your domain at hstspreload.org ↗ after turning on preload. No-Sniff Header: Sends the X-Content-Type-Options: nosniff header. Turn on to prevent browsers from MIME-type sniffing.

1. Select Save.

Send a PATCH request with security_header as the setting name in the URI path, and specify the value object that includes your HSTS settings.

Cloudflare's default cipher suites provide strong encryption for most sites. You do not need to change them unless a security audit or compliance requirement specifies particular cipher configurations.

For details on the default cipher suites and how to customize them, refer to Cipher suites. For compliance-specific cipher configurations, refer to Customize cipher suites via API.

Custom cipher suites require Advanced Certificate Manager

Customizing cipher suites requires an Advanced Certificate Manager subscription. The default cipher suites are applied automatically on all plans.

1. In the Cloudflare dashboard, go to the Security Settings page.

Go to Settings

1. (Optional) Filter by Client-side abuse.
2. Turn on Continuous script monitoring.

After turning on monitoring, it may take some time for Cloudflare to generate a list of detected scripts on your domain.

1. In the Cloudflare dashboard, go to the Web assets page.

Go to Web assets

1. Select the Client-side resources tab.
2. Review the list of detected scripts. Check for unknown or unexpected scripts from domains you do not recognize.

Depending on your Cloudflare plan, you may also be able to review connections made by scripts and check them for malicious activity. For setup details, refer to Get started with client-side security.

Content security rules require Client-Side Security Advanced

To block scripts not on your approved list, you can create content security rules that define an allowlist. This requires the Client-Side Security Advanced add-on. Refer to Content security rules for setup instructions.

Cloudflare's Automatic SSL/TLS analyzes your origin server and selects the most secure encryption mode your origin supports. If your zone uses Automatic SSL/TLS (the default for new zones), Cloudflare adjusts the mode automatically and will not downgrade to a less secure mode if your origin certificate expires.

To check whether your zone uses Automatic SSL/TLS:

1. In the Cloudflare dashboard, go to the SSL/TLS Overview page.

Go to Overview

1. Check whether Automatic SSL/TLS or Custom SSL/TLS is selected. If Custom is selected and you want Cloudflare to manage the mode automatically, select Automatic SSL/TLS.

The SSL/TLS Recommender is deprecated in favor of Automatic SSL/TLS. If you previously used the Recommender, Automatic SSL/TLS replaces it. Refer to SSL/TLS Recommender for migration details.

Use SSL Labs Server Test ↗ to verify your HTTPS configuration from outside the Cloudflare network. Enter your domain and review the report. An A or A+ grade indicates that your TLS configuration, certificate chain, and protocol support meet current security standards.

To test supported TLS versions, attempt a request to your website or application while specifying a TLS version.

For example, to test TLS 1.1, use the curl command below. Replace www.example.com with your Cloudflare domain and hostname.

Terminal window

curl https://www.example.com -svo /dev/null --tls-max 1.1

If the TLS version you are testing is blocked by Cloudflare, the TLS handshake is not completed and returns an error:

* error:1400442E:SSL routines:CONNECTCRSRVR_HELLO:tlsv1 alert

Local VPN or a device security client may prevent insecure connections using legacy protocols like TLS 1.0\. Make sure to disable such network or security client before running the test on your device.

PCI DSS compliance

For PCI DSS compliance, TLS 1.2 is the minimum required version. Refer to PCI compliance and vulnerabilities mitigation for details.