Cloudflare settings the advisor checks

The Security Advisor doesn't just check your DNS records — if your zone is hosted on Cloudflare, it also reads some of Cloudflare's own settings and tells you, in plain words, when one of them is quietly leaving your visitors unprotected. This article is for anyone using InfraNest with a Cloudflare-hosted zone.

Overview

• DNS records say where your site lives. Cloudflare's settings decide how it is served — and a site with perfect records can still be sending traffic in the clear.
• These checks appear in the Security Advisor alongside the record checks, each with an Open in Cloudflare button that takes you straight to the page where it is changed.
• InfraNest only reads these settings. Nothing is ever changed for you.

Check SSL mode

This is the setting most often left wrong, and it decides how Cloudflare talks to your own server.

1. In the Security Advisor, find the SSL mode check for your zone.
2. Understand what each value means:
   • Flexible — Cloudflare encrypts the connection to your visitors, but talks to your server over an ordinary, unencrypted one. Visitors see a padlock, but it only tells half the story. This is flagged as an error.
   • Off — the site is served without encryption at all.
   • Full — the connection to your server is encrypted, but Cloudflare does not check who answers.
   • Full (strict) — encrypted the whole way, with your server's certificate checked. This is what you want.
3. Select Open in Cloudflare to go straight to SSL/TLS → Overview.
4. Choose Full (strict).
5. If your server's certificate is self-signed and Full (strict) breaks the site, choose Full instead and fix the certificate — a free one from Let's Encrypt is enough.

Fix the minimum TLS version

TLS 1.0 and 1.1 are retired and no longer considered secure. Cloudflare still allows them unless you say otherwise, so this is usually a default nobody changed.

1. In the Security Advisor, find the TLS version check.
2. Select Open in Cloudflare to go to SSL/TLS → Edge Certificates.
3. Set Minimum TLS Version to 1.2.

Turn on Always Use HTTPS

Someone who types your address without https://, or follows an old link, should be moved to the secure version automatically. When this is off, they simply stay on the unencrypted one.

1. In the Security Advisor, find the HTTPS redirect check.
2. Select Open in Cloudflare to go to SSL/TLS → Edge Certificates.
3. Switch on Always Use HTTPS.

Turn on HSTS

HSTS tells browsers to refuse your site over an unencrypted connection at all — closing the gap on a visitor's very first request, before any redirect can help.

WarningTurn this on only once every subdomain serves HTTPS. Browsers remember the instruction for as long as you tell them to, and switching it back off does not make them forget — anything not serving HTTPS will be unreachable for returning visitors until that time runs out. This is why the advisor reports it as information rather than a warning.

1. In the Security Advisor, find the HSTS check.
2. Select Open in Cloudflare to go to SSL/TLS → Edge Certificates → HTTP Strict Transport Security.
3. Switch it on.

Turn off Development mode

Development mode switches Cloudflare's cache off so you can see changes immediately. While it is on, every request goes straight to your own server: the site is slower for visitors and your server carries the full load. Cloudflare turns it off by itself three hours after it is switched on, and the advisor stops reporting it once that time has passed.

1. In the Security Advisor, find the Development mode check.
2. Select Open in Cloudflare to go to Overview.
3. Switch Development Mode off.

Troubleshooting

Some checks are missing. If your Cloudflare connection was set up before August 2026, its API key was never asked for permission to read these settings, and Cloudflare refuses the request. The advisor then shows only the record checks and a note explaining why — it does not mark the missing checks as passed. Your DNS is unaffected and keeps working exactly as it did.

To get the checks back:

1. Open Integrations in the sidebar.
2. Select your Cloudflare connection.
3. Create a fresh API token from the connect screen — the link there pre-selects every permission InfraNest needs — or reconnect using Connect with Cloudflare.

Tips

NoteThese checks only appear for zones hosted at Cloudflare. Other DNS providers do not expose settings like these, so nothing changes for them.

• You can silence a check you have chosen deliberately. If Flexible is a deliberate choice, use Ignore on the check and it stops counting towards the zone's security status, like any other one.
• The zone list shows the result. The shield beside each zone reflects these checks too, so a zone serving unencrypted traffic no longer looks green from the overview.