The setting that causes the most problems.
THE MODES
- Off: no encryption. Never use this.
- Flexible: Cloudflare encrypts to the visitor and requests http from us. Do not use this.
- Full: encrypted to us, without validating our certificate.
- Full (strict): encrypted to us, validating our certificate. This is correct.
WHAT TO SET
Full (strict), in almost every case.
We issue valid certificates through AutoSSL, so strict validation works and is the most secure option.
WHY FLEXIBLE IS HARMFUL
Cloudflare requests http from us. Our Force HTTPS redirect sends it back to https. Cloudflare requests http again.
The result is a redirect loop, which is the most common Cloudflare complaint.
It is also insecure: the connection between Cloudflare and us is unencrypted.
IF YOU SEE A REDIRECT LOOP AFTER ENABLING CLOUDFLARE
Set SSL/TLS to Full (strict). That resolves it in seconds.
WHERE TO SET IT
Cloudflare dashboard, SSL/TLS section, Overview.
IF FULL STRICT PRODUCES AN ERROR
Our certificate may not be valid for that hostname. Run AutoSSL in cPanel covering every domain and subdomain, then retry.
