Cloudflare SSL modes, and the redirect loop they cause
Flexible, Full and Full (strict) explained — why Flexible produces “too many redirects”, and which mode to use with myPandos hosting.
Cloudflare has its own SSL setting that is separate from the certificate on your server. Choosing the wrong mode is the single most common Cloudflare problem we see, and it produces two very recognisable symptoms: an infinite redirect loop, or a padlock that is technically a lie.
The four modes
| Mode | Visitor → Cloudflare | Cloudflare → your server | Verdict |
|---|---|---|---|
| Off | Not encrypted | Not encrypted | Never use |
| Flexible | Encrypted | Not encrypted | Avoid — see below |
| Full | Encrypted | Encrypted, certificate not checked | Acceptable |
| Full (strict) | Encrypted | Encrypted and validated | Use this |
Why Flexible causes a redirect loop
In Flexible mode Cloudflare talks to your server over plain HTTP. Your server, which is configured to force HTTPS, sees an HTTP request and redirects it to HTTPS. That redirect goes back through Cloudflare, which again requests it over HTTP, and the loop never ends. Browsers stop with “too many redirects”.
Flexible is also misleading on its own terms: your visitors see a padlock, but the leg between Cloudflare and your server is unencrypted. Do not use it.
What to use instead
Set the mode to Full (strict). It requires a valid certificate on your server, which you already have:
- Shared or WordPress Hosting — install the free Let's Encrypt certificate in Plesk. See How to install or renew a free SSL certificate in Plesk.
- VPS or Cloud Hosting — issue a certificate on the server yourself. See Installing a free SSL certificate on a VPS.
Install the certificate first, then change the Cloudflare mode. Doing it the other way round takes the site down for the gap in between.
Renewal, when Cloudflare is in front
Let's Encrypt validates by fetching a file over HTTP on port 80. If that path is blocked, renewals fail silently and the certificate expires roughly 90 days later — long after anyone connects the two events. Keep port 80 reachable, or switch that domain to DNS-01 validation.
Still looping?
Check for a second redirect: a Cloudflare Page Rule or Always Use HTTPS setting fighting a redirect rule in Plesk or .htaccess. Only one of the two should be forcing HTTPS. If you are stuck, open a ticket from the Support section and tell us the domain — this one is quick for us to spot.