Which Cloudflare SSL/TLS Encryption Mode Should a Small Business Use?
Which Cloudflare SSL/TLS encryption mode should a small-business website use?
Most small-business websites should aim for Full (strict), provided the origin presents a certificate issued by a publicly trusted certificate authority or Cloudflare Origin CA. Use Full only as a constrained compatibility choice when the origin supports HTTPS but cannot yet present a certificate suitable for Full (strict). Automatic SSL/TLS can reduce routine configuration work by selecting a secure mode based on origin capabilities and checking for specified errors and inconsistent content before upgrades.
- Cloudflare documents that Full (strict) encrypts traffic going to and coming from Cloudflare.
- Full (strict) - SSL/TLS encryption modes · Cloudflare SSL/TLS docs · As of 2026-10-11
- For Full (strict), Cloudflare lists certificates issued by a publicly trusted certificate authority or Cloudflare Origin CA.
- Full (strict) - SSL/TLS encryption modes · Cloudflare SSL/TLS docs · As of 2026-10-11
- Cloudflare states that when a visitor uses HTTP, Cloudflare connects to the origin using plaintext HTTP, and vice versa.
- Full - SSL/TLS encryption modes · Cloudflare SSL/TLS docs · As of 2026-10-11
- Before upgrading a zone’s encryption mode, Cloudflare checks for 5XX errors such as 502 or 503 and evaluates whether HTTP and HTTPS content is consistent.
- Encryption modes · Cloudflare SSL/TLS docs · As of 2026-10-11
The default destination: Full (strict)
Cloudflare documents that Full (strict) encrypts traffic going to and coming from Cloudflare. For Full (strict), Cloudflare lists certificates issued by a publicly trusted certificate authority or Cloudflare Origin CA. For a small business, treat Full (strict) as the destination when one of those certificate sources is confirmed, rather than choosing by company size or familiarity with TLS.
Sources: Full (strict) - SSL/TLS encryption modes · Cloudflare SSL/TLS docs.
Before changing a live setting, confirm Cloudflare’s current prerequisites in its documentation and record who can resolve an origin-certificate problem. If the certificate source is uncertain, use that uncertainty as a stop condition until it is verified.
- Aim for Full (strict) when the origin presents a suitable certificate.
- Documented certificate sources include a publicly trusted certificate authority and Cloudflare Origin CA.
- Confirm the origin certificate before making a service-affecting change.
When Full is a temporary compatibility choice
Cloudflare says to choose Full when an origin can support an SSL certificate but cannot support a valid, publicly trusted certificate. First check whether the origin has a Cloudflare Origin CA certificate, because Cloudflare separately lists that certificate source for Full (strict). Use Full only as a constrained compatibility branch when the origin is not ready for Full (strict), and record what prevents the stricter certificate position.
Sources: Full - SSL/TLS encryption modes · Cloudflare SSL/TLS docs.
Avoid guessing about a certificate or relying on a dashboard label alone; confirm Cloudflare’s current requirements before any service-affecting change. Assign responsibility for resolving the certificate limitation rather than treating the fallback as a settled long-term decision.
- Use Full only for the narrower compatibility situation documented by Cloudflare.
- Do not choose Full when the origin already has a certificate suitable for Full (strict).
- Document the certificate limitation that prevents the stricter destination.
Check what happens to HTTP requests
Cloudflare states that when a visitor uses HTTP, Cloudflare connects to the origin using plaintext HTTP, and vice versa. A business considering Full should therefore check whether visitors can still reach HTTP request paths and avoid assuming that the mode name forces HTTPS for every origin connection. Treat this as a request-path consequence to review alongside certificate readiness, not as a reason to avoid Full (strict) when the origin is ready.
Sources: Full - SSL/TLS encryption modes · Cloudflare SSL/TLS docs.
Before changing request behaviour or encryption settings, check Cloudflare’s current documentation and preserve a clear record of the intended outcome.
- Full follows the visitor-requested scheme for the origin connection.
- An HTTP visitor request results in plaintext HTTP to the origin under Full.
- Review request handling instead of assuming Full enforces HTTPS everywhere.
Where Automatic SSL/TLS fits
Cloudflare says Automatic SSL/TLS uses its SSL/TLS Recommender to select the most secure encryption mode for a website. Before upgrading a zone’s encryption mode, Cloudflare checks for 5XX errors such as 502 or 503 and evaluates whether HTTP and HTTPS content is consistent. Cloudflare says the Recommender considers the current encryption mode, origin certification and origin capabilities when automatically adjusting settings for a domain.
Sources: Encryption modes · Cloudflare SSL/TLS docs.
Automatic SSL/TLS is a reasonable low-maintenance choice when the business wants Cloudflare to make suitable mode selections using those inputs. Do not treat the documented checks as a universal guarantee that no change can affect service; assign an owner for the chosen control model.
- Automatic SSL/TLS uses Cloudflare’s Recommender to select a secure mode.
- Cloudflare checks for specified 5XX errors and HTTP/HTTPS content consistency before upgrades.
- Automatic checks do not remove the need for accountable review.
Understand the two-connection boundary
A Cloudflare Community contributor explains that information is decrypted on Cloudflare’s side and then re-encrypted. This background explanation distinguishes encrypted connections on both legs from one uninterrupted encrypted connection directly between a visitor and the origin. Base the mode decision on Cloudflare’s authoritative certificate and origin-capability guidance, using the connection boundary only as a plain-language mental model.
Sources: Full vs Strict Mode - Application Security / SSL / TLS - Cloudflare Community.
If a security requirement depends on a particular traffic boundary, obtain advice appropriate to that requirement rather than inferring more from this general explanation.
- Cloudflare proxying involves separate encrypted connections on either side of Cloudflare.
- A Cloudflare Community contributor describes decryption and re-encryption at Cloudflare.
- Use this as background context, not as the basis for choosing a mode.
Origin-capability decision table
Use this decision table to turn origin certificate capability into a documented mode decision. It is a planning aid, not a server test or complete configuration procedure.
| Origin position | Recommended choice | Why this fits | Record before change |
|---|---|---|---|
| Origin presents a certificate from a publicly trusted authority or Cloudflare Origin CA | Full (strict) | Cloudflare lists these certificate sources for Full (strict) and documents encrypted traffic going to and coming from Cloudflare. | Certificate source and accountable owner |
| Origin supports an SSL certificate but does not have a certificate suitable for Full (strict) | Full as a constrained compatibility choice | Cloudflare identifies Full for an origin that can support an SSL certificate but cannot support a valid, publicly trusted certificate; separately check for Cloudflare Origin CA before choosing the weaker option. | Certificate limitation and person responsible for resolving it |
| Business wants Cloudflare to manage suitable mode selection | Automatic SSL/TLS | Cloudflare says its Recommender evaluates the current mode, origin certification and origin capabilities. | Named owner and review trigger |
| Visitors can use HTTP while the website uses Full | Review request handling | Cloudflare says an HTTP visitor request leads to plaintext HTTP from Cloudflare to the origin. | Whether HTTP request paths need separate attention |
Confirm Cloudflare’s current prerequisites in its documentation before a service-affecting change. This table does not guarantee availability or replace technical verification.
Related guidance
Editorial position
Small-business websites should aim for Full (strict) when their origin presents a certificate issued by a publicly trusted certificate authority or Cloudflare Origin CA. Use Full only as a constrained compatibility choice when the origin supports HTTPS but does not yet have a certificate suitable for Full (strict). Automatic SSL/TLS is a sensible low-maintenance option when Cloudflare should evaluate origin capabilities and manage suitable changes; the decision depends on origin readiness, not business size alone.
What follow-up questions matter most?
- Which Cloudflare mode should most small businesses aim for?
- Aim for Full (strict) when the origin presents a certificate issued by a publicly trusted certificate authority or Cloudflare Origin CA. Confirm that certificate position before changing a live setting.
- When is Full a reasonable choice?
- Full is a compatibility choice when the origin supports HTTPS but cannot currently support a valid, publicly trusted certificate. If the origin has a Cloudflare Origin CA certificate, it fits the documented Full (strict) certificate options instead. Treat Full as a reason to resolve certificate readiness, not as an equal long-term preference.
- Does Full make every origin connection HTTPS?
- No. Cloudflare documents that, under Full, an HTTP visitor request leads to a plaintext HTTP connection from Cloudflare to the origin. Review how the website handles HTTP rather than assuming the mode name forces HTTPS on every request path.
- Should I use Automatic SSL/TLS?
- Automatic SSL/TLS is useful when low-maintenance management is the priority. Cloudflare says its Recommender evaluates the current mode, origin certificate and origin capabilities, and checks for specified errors and content consistency before upgrades.
What steps does this workflow follow?
Choose a Cloudflare SSL/TLS mode by origin readiness
- Identify the origin certificate position: Confirm whether the origin presents a certificate issued by a publicly trusted certificate authority or Cloudflare Origin CA. If the answer is uncertain, pause and verify Cloudflare's current requirements in its documentation.
- Select the destination mode: Choose Full (strict) when a documented Full (strict) certificate source is confirmed. Consider Full only where the origin supports HTTPS but cannot yet support a valid, publicly trusted certificate and does not already have another certificate source suitable for Full (strict).
- Review HTTP request handling: If considering Full, check whether visitors can still reach HTTP request paths. Cloudflare documents that an HTTP visitor request results in plaintext HTTP between Cloudflare and the origin under Full.
- Decide who manages future changes: Choose Automatic SSL/TLS when Cloudflare should evaluate origin capabilities and manage suitable mode changes. Keep manual control only when a named person can explain and review the reason.
- Record the decision and limitation: Record the chosen mode, certificate position, accountable owner and unresolved issues. Before a service-affecting change, confirm Cloudflare's current prerequisites in its own documentation.