Cloudflare
Security & compliance
Releases
Stability
Performance
Edge TLS posture
Whether the padlock covers the whole path to your origin.
Overview
Reads your Cloudflare zone’s SSL mode, minimum TLS version, HSTS, and DNSSEC settings, and reports the ones that leave a leg of the connection unencrypted or downgradable.
What it looks for
- SSL mode off or flexible, leaving an unencrypted origin hop
- Minimum TLS version below 1.2, TLS 1.3 not enabled
- Always Use HTTPS off, Automatic HTTPS Rewrites off
- HSTS missing, disabled, or with a max-age under six months
- DNSSEC not active, 0-RTT early data enabled
Why it matters
SSL mode set to Flexible terminates TLS at Cloudflare and speaks plain HTTP to your origin — visitors see a padlock over a connection that is unencrypted for its final hop. TLS 1.0 and 1.1 remain negotiable until you raise the floor.
Rules in this check
| What it reports | Fix path |
|---|---|
| SSL mode off/flexible (unencrypted origin hop) | Guide |
| Minimum TLS version below 1.2 | Guide |
| Always Use HTTPS is off | Guide |
| DNSSEC not active on the zone | Guide |
| Automatic HTTPS Rewrites off (mixed-content risk) | Guide |
| TLS 1.3 not enabled | Guide |
| HSTS missing, disabled, or max-age under 6 months | Guide |
| 0-RTT early data enabled (request replay risk) | Guide |
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.