Securing web traffic with SSL/TLS encryption is a fundamental requirement for modern websites and web applications. Cloudflare provides a straightforward way to enable HTTPS, protect traffic at the network edge, and improve overall website security without requiring a paid subscription.
This guide provides a step-by-step walkthrough for integrating a website with Cloudflare, configuring SSL/TLS correctly, enforcing HTTPS, and optionally securing the connection between Cloudflare and the origin server with a Cloudflare Origin CA certificate.
1. Create or Access a Cloudflare Account
Begin by visiting Cloudflare and creating a new account or signing in to an existing one. Cloudflare supports conventional email-based authentication as well as sign-in options such as Google and Apple.
After authentication, you will be taken to the Cloudflare dashboard, where you can manage domains, DNS records, security settings, SSL/TLS configuration, and other services.
2. Add Your Domain to Cloudflare
From the Cloudflare dashboard, select the option to Add a site and enter your root domain, such as:
example.com
Cloudflare will scan the domain’s existing DNS records and attempt to import them automatically.
Before continuing, carefully review the imported records. Make sure important services—such as www, mail, FTP, APIs, and other subdomains—have the correct DNS records. Incorrect or missing records can interrupt website or email functionality after the nameserver change.
3. Select the Cloudflare Plan
Cloudflare will ask you to select a plan. Although paid plans provide additional performance, security, and management features, the Free Plan is generally sufficient for many personal websites, blogs, portfolios, and small business websites.
The Free Plan includes the essential Cloudflare functionality required for HTTPS and edge-based SSL/TLS protection.
4. Update Your Domain’s Nameservers
For Cloudflare to manage DNS and proxy traffic for your domain, you must update the domain’s authoritative nameservers.
Cloudflare will provide two assigned nameservers, for example:
adam.ns.cloudflare.com
emma.ns.cloudflare.com
The exact nameservers will be different for each domain.
Log in to your domain registrar—such as Namecheap, GoDaddy, Hostinger, or another registrar—and replace the existing nameservers with the two provided by Cloudflare.
DNS changes can become effective within minutes, but global propagation may take longer. Allow up to 24 hours for the change to propagate across DNS resolvers.
Once Cloudflare detects the nameserver change, the domain will become active in your Cloudflare account.
5. Configure the SSL/TLS Encryption Mode
Although the term SSL is still commonly used, modern web encryption is based primarily on TLS (Transport Layer Security).
In the Cloudflare dashboard, navigate to:
SSL/TLS → Overview
Cloudflare provides several encryption modes that determine how traffic is secured between the visitor, Cloudflare, and your origin server.
For production websites, Full (Strict) is generally the preferred configuration when the origin server has a valid certificate.
With Full (Strict):
Visitor
↓ HTTPS
Cloudflare
↓ HTTPS
Origin Server
Both connections are encrypted, and Cloudflare validates the certificate presented by the origin server.
Avoid selecting Full (Strict) until the origin server has a valid certificate that Cloudflare can authenticate. If the origin does not have an appropriate certificate, Cloudflare may return SSL-related errors such as 526 Invalid SSL Certificate.
6. Enable HTTPS Enforcement
After configuring the SSL/TLS mode, navigate to:
SSL/TLS → Edge Certificates
Review the available edge certificate settings and enable Always Use HTTPS.
This redirects HTTP requests to HTTPS, ensuring that visitors who enter:
http://example.com
are redirected to:
https://example.com
HTTPS should be the canonical version of the site, particularly for websites that handle authentication, forms, personal information, or other sensitive data.
7. Configure Automatic HTTPS Rewrites
If your website contains resources referenced using HTTP—for example:
<img src="http://example.com/image.jpg">
the browser may report mixed-content problems when the page itself is loaded over HTTPS.
Cloudflare’s Automatic HTTPS Rewrites feature can rewrite compatible HTTP resource references to HTTPS where appropriate.
This can help reduce mixed-content warnings without requiring every legacy URL to be manually modified.
However, it should not be treated as a replacement for properly updating hard-coded HTTP URLs within the website’s source code.
8. Verify the SSL/TLS Configuration
After the configuration is complete, verify that HTTPS is working correctly.
Browser Test
Open:
https://example.com
Confirm that the browser establishes a secure HTTPS connection. Selecting the site’s security information in the browser should provide certificate details, including the certificate authority and validity information.
Command-Line Test
From a terminal, run:
curl -I https://example.com
A successful request may return a response such as:
HTTP/2 200
If the site redirects another URL to HTTPS, you may instead see:
HTTP/2 301
or another appropriate redirect response.
For a more detailed TLS handshake and certificate inspection, you can also use:
curl -Iv https://example.com
External SSL Testing
For an independent assessment, services such as Qualys SSL Labs’ SSL Server Test can analyze the certificate chain, supported TLS versions, cipher suites, protocol configuration, and other aspects of the server’s TLS implementation.
9. Optional: Install a Cloudflare Origin CA Certificate
For stronger end-to-end encryption between Cloudflare and the origin server, you can install a Cloudflare Origin CA certificate on the server.
This is particularly useful when you want to use Full (Strict) but do not want to obtain a publicly trusted certificate directly from another certificate authority.
In Cloudflare, navigate to:
SSL/TLS → Origin Server → Create Certificate
Cloudflare will allow you to specify:
- The hostnames the certificate should cover
- The key type, such as RSA or ECC
- The certificate validity period
- Whether Cloudflare should generate the private key and CSR
For example, you might include:
example.com
*.example.com
After creating the certificate, Cloudflare provides the certificate and private key.
The certificate might be saved as:
cert.pem
and the private key as:
privkey.pem
Install these files on the origin server and configure your web server—such as Nginx or Apache—to use them for HTTPS.
Important: The private key must be protected carefully. Do not publish it, commit it to a source-code repository, or expose it through a publicly accessible directory.
Once the origin certificate has been correctly installed and HTTPS is working on the server, configure Cloudflare’s SSL/TLS mode as:
Full (Strict)
This provides encryption on both legs of the connection:
Browser
│
│ HTTPS
▼
Cloudflare Edge
│
│ HTTPS + validated origin certificate
▼
Origin Server
10. Final Verification Checklist
Before considering the deployment complete, verify the following:
- The domain is active in Cloudflare.
- The correct Cloudflare nameservers are configured at the registrar.
- All required DNS records were imported and verified.
- An appropriate SSL/TLS mode is configured.
- The origin server has a valid certificate when using Full (Strict).
- Always Use HTTPS is enabled.
- Mixed-content issues have been addressed.
https://example.comloads successfully.- HTTP requests redirect to HTTPS where expected.
- The certificate is valid and has not expired.
- External TLS testing reports no critical configuration problems.
Conclusion
Cloudflare makes deploying HTTPS relatively straightforward by providing SSL/TLS protection at its network edge while also offering tools for securing the connection to the origin server.
For a production environment, a strong baseline configuration is to use Full (Strict) with a properly configured origin certificate, enforce HTTPS, and regularly verify the certificate and TLS configuration.
The result is a secure connection path from the visitor to Cloudflare and from Cloudflare to the hosting server, providing encryption throughout the application’s network path.