Cloudflare Docs
SSL/TLS
SSL/TLS
Edit this page
Give us feedback
Set theme to dark (⇧+D)

Flexible - SSL/TLS encryption modes

Setting your encryption mode to Flexible makes your site partially secure. Cloudflare allows HTTPS connections between your visitor and Cloudflare, but all connections between Cloudflare and your origin are made through HTTP. As a result, an SSL certificate is not required on your origin.

​​ Use when

Choose this option when you cannot set up an SSL certificate on your origin or your origin does not support SSL/TLS.

​​ Required setup

​​ Prerequisites

Depending on your origin configuration, you may have to adjust settings to avoid Mixed Content errors or redirect loops.

​​ Process

To change your encryption mode in the dashboard:

  1. Log in to the Cloudflare dashboard and select your account and domain.
  2. Go to SSL/TLS.
  3. Choose an encryption mode.
To adjust your encryption mode with the API, send a PATCH request with the value parameter set to your desired setting (off, flexible, full, strict).

​​ Limitations

Flexible mode is only supported for HTTPS connections on port 443 (default port). Other ports using HTTPS will fall back to Full mode.

If your application contains sensitive information (personalized data, user login), use Full or Full (Strict) modes instead.

Authenticated Origin Pull does not work when your SSL/TLS encryption mode is set to Off or Flexible.