Cloudflare SSL modes: which to choose

Cloudflare acts as a middle layer between visitors and your server. The SSL/TLS mode controls whether Cloudflare connects to your UnderHost server over HTTP or HTTPS, and whether it validates the server certificate.

SSL mode overview

Flexible: avoid this on UnderHost

Flexible mode sends traffic from Cloudflare to your server over plain HTTP even though visitors connect to Cloudflare over HTTPS. This is the most common cause of Cloudflare redirect loops on hosting accounts that already force HTTPS.

• The visitor requests HTTPS.
• Cloudflare connects to the origin over HTTP.
• The UnderHost server redirects HTTP to HTTPS.
• Cloudflare repeats the HTTP origin request and the browser reports too many redirects.

Do not use Flexible if your domain already has a valid SSL certificate on the UnderHost server.

Full

Full mode connects from Cloudflare to your server over HTTPS but does not require the origin certificate to be publicly trusted. It can work with a self-signed or Cloudflare Origin Certificate, but it is less strict than Full (Strict).

Full (Strict): recommended

Full (Strict) connects from Cloudflare to your server over HTTPS and validates the certificate. Since UnderHost hosting can use valid SSL certificates through AutoSSL or Let's Encrypt, Full (Strict) is the recommended mode when the certificate is active.

1. Confirm SSL is active for the domain on the UnderHost server.
2. Open the Cloudflare dashboard.
3. Go to SSL/TLS -> Overview.
4. Select Full (Strict).

Fix redirect loops

If the site shows ERR_TOO_MANY_REDIRECTS after enabling Cloudflare:

1. Check the Cloudflare SSL/TLS mode. If it is set to Flexible, change it to Full or Full (Strict).
2. Confirm the origin SSL certificate is valid on the UnderHost server.
3. Review site and application redirects so HTTP always resolves consistently to HTTPS.
4. Clear Cloudflare cache and test in a private browser window.

Related articles