# Cloudflare settings the advisor checks

> Some of the most important security settings for a website are not DNS records at all.

Source: https://infranest.io/docs/cloudflare-security-settings
Last updated: 2026-09-05

---

Learn what the Security Advisor checks in your Cloudflare account settings, and how to fix any issues it finds. This is for anyone whose website's DNS zone is hosted on Cloudflare.

## Overview

- Your DNS records control *where* your site lives, but Cloudflare's own settings control *how* it is served — and a zone with perfect records can still be sending traffic unprotected.
- If your zone is on Cloudflare, the Security Advisor reads these settings and explains, in plain words, when something is quietly leaving your visitors unprotected.
- These checks appear alongside your record checks, each with an **Open in Cloudflare** button that takes you straight to the page where it's changed.

> [!NOTE]
> InfraNest only reads these settings — it never changes anything for you.

## Check and fix SSL mode

This is the setting most often left wrong, and it decides how Cloudflare talks to your own server.

1. In Cloudflare, look at how your **SSL/TLS → Overview** page is set.
2. Understand what each option means:
   - **Flexible** — Cloudflare encrypts the connection to your visitors, but talks to your server over an unencrypted one. Visitors see a padlock, but it's only telling half the story. This is flagged as an error.
   - **Off** — the site is served without any encryption.
   - **Full** — the connection to your server is encrypted, but Cloudflare doesn't verify who answers, so someone in the middle could pretend to be your server.
   - **Full (strict)** — encrypted the whole way, with your server's certificate checked. This is what you want.
3. Choose **Full (strict)**.
4. If your server's certificate is self-signed and Full (strict) breaks the site, choose **Full** instead and fix the certificate — a free one from Let's Encrypt is enough.

## Check and fix the minimum TLS version

TLS 1.0 and 1.1 are retired and no longer secure, but Cloudflare still allows them unless you change it.

1. Go to **SSL/TLS → Edge Certificates**.
2. Set **Minimum TLS Version** to **1.2**.

## Turn on Always Use HTTPS

Without this, someone who types your address without `https://`, or follows an old link, stays on the unencrypted version instead of being moved to the secure one.

1. Go to **SSL/TLS → Edge Certificates**.
2. Switch on **Always Use HTTPS**.

## Turn on HSTS

HSTS tells browsers to refuse your site over an unencrypted connection at all, closing the gap on a visitor's very first request.

1. Go to **SSL/TLS → Edge Certificates → HTTP Strict Transport Security**.
2. Switch it on.

> [!WARNING]
> Turn this on only once **every** subdomain serves HTTPS. Browsers remember the instruction for as long as you tell them to, and turning it back off does not make them forget — anything not serving HTTPS will be unreachable for returning visitors until that time runs out. This is why the advisor reports it as information rather than a warning.

## Turn off Development mode

Development mode switches Cloudflare's cache off so you can see changes immediately. While it's on, every request goes straight to your own server — the site is slower for visitors and your server carries the full load. Cloudflare turns it off automatically three hours after it's switched on, and the advisor stops reporting it once that time has passed.

1. Open **Overview** in Cloudflare.
2. Switch **Development Mode** off.

## Troubleshooting

**Checks are missing entirely.** If your Cloudflare connection was set up before August 2026, its API key was never asked for permission to read these settings, and Cloudflare refuses the request. The advisor then shows only the record checks, along with a note explaining why — it does not mark the missing checks as passed. Your DNS is unaffected and keeps working exactly as it did.

To get the checks back:
1. Go to **Settings → Integrations**.
2. Open your Cloudflare connection.
3. Create a fresh API token from the connect screen (the link there pre-selects every permission InfraNest needs), or reconnect using **Connect with Cloudflare**.

## Tips

- These checks only appear for zones hosted at Cloudflare. Other DNS providers don't expose settings like these, so nothing changes for them.
- If a setting like Flexible SSL mode is a deliberate choice you've made, you can use **Ignore** on that check so it stops counting towards the zone's security status.
- The shield beside each zone in your zone list reflects these checks too, so a zone serving unencrypted traffic no longer looks green from the overview.