The single most common Cloudflare misconfiguration.
WHAT HAPPENS
Flexible tells Cloudflare to fetch your pages over plain http, while serving https to visitors.
Your server, correctly configured to force https, receives the http request and responds with a redirect to https. Cloudflare follows it, still requesting http from the origin. The loop continues until the browser gives up.
WHAT YOU SEE
ERR_TOO_MANY_REDIRECTS, or a page that never loads.
WHY PEOPLE CHOOSE IT
It appears to give https without needing a certificate on the server. It was a reasonable option before free certificates existed. It is not now.
THE OTHER PROBLEM
Traffic between Cloudflare and your server is unencrypted. Anyone positioned on that path can read it. The padlock visitors see is misleading.
THE FIX
- Run AutoSSL so a valid certificate exists on our server.
- Set Cloudflare SSL/TLS to Full (strict).
- Test in a private window.
NEVER USE FLEXIBLE
There is no situation on our hosting where it is the right choice.
