Cloudflare sits between visitors and your origin server, which adds one extra layer to account for beyond a normal HTTPS redirect: the SSL/TLS mode setting controlling the connection between Cloudflare and your actual server.
The four SSL/TLS modes
- Off — no encryption at all; never use this in production.
- Flexible — encrypts visitor-to-Cloudflare, but Cloudflare-to-origin stays plain HTTP. This is the most common cause of redirect loops when your origin server also tries to force HTTPS.
- Full — encrypts both hops, but doesn't validate your origin certificate (works even with a self-signed one).
- Full (Strict) — encrypts both hops and validates your origin certificate against a trusted CA. The recommended setting if your origin has a valid certificate.
Enabling the redirect
Under SSL/TLS → Edge Certificates, enable "Always Use HTTPS" — this handles the redirect at Cloudflare's edge, before the request even reaches your origin server, which is simpler and faster than relying on an origin-level redirect alone.
Fixing the classic redirect loop
If you're stuck in a redirect loop, it's almost always "Flexible" mode combined with an origin server also trying to force HTTPS — the origin sees plain HTTP from Cloudflare and redirects, Cloudflare redirects back, endlessly. Switch to "Full" or "Full (Strict)" once your origin has a working certificate.
Why Flexible mode is the default that causes the most confusion
Cloudflare's Flexible SSL mode is often the easiest to initially enable, since it doesn't require any certificate on your origin server at all — but this exact convenience is what causes the classic redirect loop when an origin server also tries to enforce its own HTTPS redirect, since the origin never actually receives an HTTPS connection to check against.
What Always Use HTTPS does differently from a manual redirect rule
Cloudflare's Always Use HTTPS setting handles the redirect at Cloudflare's edge network, before the request ever reaches your origin server at all — this is both faster (no round trip to your origin needed just to redirect) and simpler to manage than relying solely on an origin-level redirect rule.
What Full (Strict) mode specifically requires from your origin server
Full (Strict) mode validates your origin's certificate against a trusted CA, meaning a self-signed or expired origin certificate will cause Cloudflare to refuse the connection — confirming your origin has a valid, currently trusted certificate installed is a prerequisite before switching to this most secure mode.
What Cloudflare's Edge Certificates panel shows beyond the basic SSL mode setting
Beyond the SSL/TLS mode itself, the Edge Certificates panel shows your current Universal SSL certificate's status, coverage, and validity, along with options for advanced certificate configuration — worth reviewing directly rather than assuming based on the mode setting alone.
How Cloudflare Page Rules can supplement or override the Always Use HTTPS setting
Page Rules can implement more granular redirect behavior for specific URL patterns if needed, though for most sites the simpler, site-wide Always Use HTTPS setting is sufficient and less prone to the rule-ordering complexity that multiple overlapping Page Rules can introduce.
Why Cloudflare's Universal SSL differs from a dedicated custom certificate option
Universal SSL is a free, shared certificate type covering your domain automatically; Cloudflare also offers dedicated custom certificate options for organizations with specific validation-level requirements (OV/EV) beyond what the free, automatic Universal SSL tier provides.
A final word on choosing the right SSL mode for your specific situation
When in doubt between Cloudflare's SSL modes, Full (Strict) is the generally recommended choice for any origin with a valid certificate already installed — reserve Flexible only for the specific, increasingly rare scenario where your origin genuinely cannot support HTTPS at all.
What Cloudflare Workers can add for more advanced redirect logic if ever needed
For redirect logic beyond what Cloudflare's standard Page Rules or Always Use HTTPS setting supports, Cloudflare Workers lets you write custom JavaScript executed at the edge for genuinely advanced, conditional redirect scenarios — unnecessary for a standard HTTPS migration but available for unusual, complex requirements.
How Cloudflare's free versus paid plans differ regarding SSL mode options
All Cloudflare plan tiers, including the free tier, include access to the core SSL/TLS modes covered in this guide (Flexible, Full, Full Strict) — paid plans add additional certificate customization options and dedicated certificate support beyond what most standard migrations require.