Cloudflare settings the advisor checks

If your website's DNS is hosted on Cloudflare, this article explains the extra security checks InfraNest runs on your Cloudflare settings — useful for anyone who wants their site to actually be as secure as it looks.

#Overview

• Your DNS records say where your site lives, but Cloudflare's own settings decide how it is served — and those settings can quietly leave visitors unprotected even when your records look fine.
• The Security Advisor reads these settings and reports on them alongside your usual record checks.
• InfraNest never changes any of these settings for you — it only tells you what it found, with an Open in Cloudflare button that takes you straight to the right page to fix it.

#Understand the checks

1. SSL mode — this is the setting most often left wrong, and it matters most. It controls how Cloudflare talks to your own server.

• Flexible encrypts traffic to your visitors but talks to your server in the clear — flagged as an error.
• Off serves the site with no encryption at all.
• Full encrypts the connection to your server, but doesn't check who answers.
• Full (strict) is encrypted the whole way, with your server's certificate checked — this is what you want.
• To change it: in Cloudflare, open SSL/TLS → Overview and choose Full (strict). If your server uses a self-signed certificate and this breaks the site, choose Full and get a free certificate from Let's Encrypt instead.

2. Minimum TLS version — TLS 1.0 and 1.1 are retired and no longer secure, but Cloudflare still allows them unless you say otherwise.

   • To change it: go to SSL/TLS → Edge Certificates and set Minimum TLS Version to 1.2.

3. Always Use HTTPS — without this, anyone who types your address without https://, or follows an old link, stays on the unencrypted version instead of being moved to the secure one.

   • To change it: go to SSL/TLS → Edge Certificates and switch on Always Use HTTPS.

4. HSTS — tells browsers to refuse your site over an unencrypted connection entirely, closing the gap on a visitor's very first request.

   WarningTurn this on only once every subdomain serves HTTPS. Browsers remember this instruction for as long as you tell them to, and turning it back off does not make them forget — anything not serving HTTPS becomes unreachable for returning visitors until that time runs out. This is why the advisor reports it as information rather than a warning.

   • To change it: go to SSL/TLS → Edge Certificates → HTTP Strict Transport Security.

5. Development mode — switches off Cloudflare's cache so you can see changes immediately, but while it's on, every request goes straight to your own server, making the site slower and putting the full load on your server. Cloudflare turns it off automatically after three hours, and the advisor stops reporting it once that time has passed.

• To change it: open Overview in Cloudflare and switch Development Mode off.

#Fix a missing check

1. If your Cloudflare connection was set up before August 2026, its API key was never asked for permission to read these settings, so Cloudflare refuses the request. When this happens, the advisor shows only the record checks and a note explaining why — it never marks the missing checks as passed.
2. Your DNS is unaffected and keeps working exactly as it did.
3. To get the checks back, open Integrations in the sidebar, then open your Cloudflare connection.
4. Create a fresh API token from the connect screen — the link there pre-selects every permission InfraNest needs — or reconnect using Connect with Cloudflare.

#Tips

• These checks only appear for zones hosted at Cloudflare. Other DNS providers don't expose settings like these, so nothing changes for them.
• If Flexible SSL mode is a deliberate choice, you can use Ignore on that check so it stops counting towards the zone's security status, just like any other check.

NoteThe shield shown beside each zone in your zone list reflects these checks too, so a zone serving unencrypted traffic no longer looks green from the overview.