sellSecurity

https

SSL/TLS

The padlock in the address bar — it encrypts traffic so nobody can read or tamper with it.

FreeUniversal SSL certificates

Auto-renewNo manual renewals

Full (strict)Recommended mode

lightbulb

What is SSL/TLS?

SSL/TLS is the technology that encrypts the connection between a visitor's browser and your website. It's what turns http:// into the secure https:// with a padlock icon.

TLS (Transport Layer Security) is the modern version; SSL is the older name people still use. To prove your site is really yours, it presents a certificate — a digital ID card signed by a trusted authority. Cloudflare issues these for free.

mail_lock

Think of it like…

Sending a sealed, tamper-proof envelope instead of a postcard. Without TLS, anyone handling the mail (your Wi-Fi, your ISP) can read everything; with it, only the recipient can open it.

help

Why does it matter?

visibility_off

Privacy

Encrypts passwords, payments, and personal data so eavesdroppers see only scrambled noise.

verified

Trust

Browsers label http:// sites 'Not secure'. The padlock reassures visitors your site is legit.

SEO ranking

Google ranks HTTPS sites higher than insecure ones.

edit_off

No tampering

Stops attackers injecting ads or malware into pages as they travel to the visitor.

tune

Encryption modes

There are two legs of the journey: visitor → Cloudflare, and Cloudflare → your origin server. The encryption mode controls how the second leg is secured. Cloudflare recommends Full (strict).

lock_open

Off

No encryption at all. Almost never appropriate — everything is sent as plain text.

lock

Flexible

Visitor→Cloudflare is encrypted, but Cloudflare→origin is not. A stopgap for origins that can't do HTTPS yet.

https

Full

Both legs encrypted, but the origin's certificate isn't validated. OK for self-signed certs.

gpp_good

Full (strict) ⭐

Both legs encrypted AND the origin certificate is validated. The recommended, most secure option.

rocket_launch

How to enable HTTPS

Once your site is on Cloudflare, a free Universal SSL certificate is issued automatically. These steps make sure every visitor uses HTTPS.

Confirm Universal SSL is active
Go to SSL/TLS → Edge Certificates. Your free certificate appears here automatically, usually within minutes of adding your domain.
Set the encryption mode
Go to SSL/TLS → Overview and choose Full (strict). Make sure your origin server has a valid certificate — Cloudflare offers a free Origin CA certificate for exactly this.
Turn on Always Use HTTPS
Go to SSL/TLS → Edge Certificates and enable Always Use HTTPS. Any http:// visitor is instantly redirected to the secure https:// version.
Enable Automatic HTTPS Rewrites
On the same page, switch on Automatic HTTPS Rewrites so old http:// links inside your pages are fixed on the fly, avoiding 'mixed content' warnings.

info

Get a free origin certificate

Under SSL/TLS → Origin Server, click Create Certificate to generate a free Cloudflare Origin CA cert (valid up to 15 years) and install it on your server — this is what makes Full (strict) work.

school

Key concepts

card_membership

Certificate

A digital ID that proves your domain's identity and holds the keys used to encrypt traffic.

public

Edge certificate

Secures the visitor → Cloudflare leg. Universal SSL provides this for free, auto-renewed.

dns

Origin certificate

Secures the Cloudflare → origin leg. Cloudflare's free Origin CA cert fills this role.

all_inclusive

Total TLS

Automatically issues certificates for every subdomain, so nothing is left unencrypted.

autorenew

Auto-renewal

Cloudflare renews certificates before they expire — no more 'certificate expired' outages.

key

Origin CA cert

A free certificate from Cloudflare to install on your server, valid for up to 15 years.

tips_and_updates

Tips & billing

warning

Avoid Flexible mode

Flexible can cause redirect loops and leaves the Cloudflare→origin leg unencrypted. As soon as your server supports HTTPS, switch to Full (strict).

Universal SSL is free on every Cloudflare plan, including Free.
Certificates auto-renew, so you never deal with expiry yourself.
Use the Origin CA certificate (free) to enable secure Full (strict) without buying anything.
Advanced certificates and uploading your own custom certificate are available on paid plans.