Cloudflare settings the advisor checks

Learn what the Security Advisor checks in your Cloudflare account settings, and how to fix any issues it finds. This is for anyone whose website's DNS zone is hosted on Cloudflare.

Overview

• Your DNS records control where your site lives, but Cloudflare's own settings control how it is served — and a zone with perfect records can still be sending traffic unprotected.
• If your zone is on Cloudflare, the Security Advisor reads these settings and explains, in plain words, when something is quietly leaving your visitors unprotected.
• These checks appear alongside your record checks, each with an Open in Cloudflare button that takes you straight to the page where it's changed.

NoteInfraNest only reads these settings — it never changes anything for you.

Check and fix SSL mode

This is the setting most often left wrong, and it decides how Cloudflare talks to your own server.

1. In Cloudflare, look at how your SSL/TLS → Overview page is set.
2. Understand what each option means:
   • Flexible — Cloudflare encrypts the connection to your visitors, but talks to your server over an unencrypted one. Visitors see a padlock, but it's only telling half the story. This is flagged as an error.
   • Off — the site is served without any encryption.
   • Full — the connection to your server is encrypted, but Cloudflare doesn't verify who answers, so someone in the middle could pretend to be your server.
   • Full (strict) — encrypted the whole way, with your server's certificate checked. This is what you want.
3. Choose Full (strict).
4. If your server's certificate is self-signed and Full (strict) breaks the site, choose Full instead and fix the certificate — a free one from Let's Encrypt is enough.

Check and fix the minimum TLS version

TLS 1.0 and 1.1 are retired and no longer secure, but Cloudflare still allows them unless you change it.

1. Go to SSL/TLS → Edge Certificates.
2. Set Minimum TLS Version to 1.2.

Turn on Always Use HTTPS

Without this, someone who types your address without https://, or follows an old link, stays on the unencrypted version instead of being moved to the secure one.

1. Go to SSL/TLS → Edge Certificates.
2. Switch on Always Use HTTPS.

Turn on HSTS

HSTS tells browsers to refuse your site over an unencrypted connection at all, closing the gap on a visitor's very first request.

1. Go to SSL/TLS → Edge Certificates → HTTP Strict Transport Security.
2. Switch it on.

WarningTurn this on only once every subdomain serves HTTPS. Browsers remember the instruction for as long as you tell them to, and turning it back off does not make them forget — anything not serving HTTPS will be unreachable for returning visitors until that time runs out. This is why the advisor reports it as information rather than a warning.

Turn off Development mode

Development mode switches Cloudflare's cache off so you can see changes immediately. While it's on, every request goes straight to your own server — the site is slower for visitors and your server carries the full load. Cloudflare turns it off automatically three hours after it's switched on, and the advisor stops reporting it once that time has passed.

1. Open Overview in Cloudflare.
2. Switch Development Mode off.

Troubleshooting

Checks are missing entirely. If your Cloudflare connection was set up before August 2026, its API key was never asked for permission to read these settings, and Cloudflare refuses the request. The advisor then shows only the record checks, along with a note explaining why — it does not mark the missing checks as passed. Your DNS is unaffected and keeps working exactly as it did.

To get the checks back:

1. Go to Settings → Integrations.
2. Open your Cloudflare connection.
3. Create a fresh API token from the connect screen (the link there pre-selects every permission InfraNest needs), or reconnect using Connect with Cloudflare.

Tips

• These checks only appear for zones hosted at Cloudflare. Other DNS providers don't expose settings like these, so nothing changes for them.
• If a setting like Flexible SSL mode is a deliberate choice you've made, you can use Ignore on that check so it stops counting towards the zone's security status.
• The shield beside each zone in your zone list reflects these checks too, so a zone serving unencrypted traffic no longer looks green from the overview.