This guide has been updated. The original version was written in 2015 and described the Cloudflare dashboard of that era, with its Crypto tab and Flexible SSL option. Cloudflare has redesigned its dashboard since then, and the recommended way to secure a WordPress site has also changed. This article walks through the current approach.
Understand the SSL options today
Cloudflare offers several encryption modes, set under the SSL/TLS section of your zone dashboard:
- Flexible encrypts traffic between visitors and Cloudflare, but not between Cloudflare and your server. It is easy to set up, but Cloudflare now recommends it only for simple cases and discourages it for sites handling logins or personal data.
- Full encrypts the connection all the way to your server, without validating the certificate on the server.
- Full (strict) also encrypts the full connection and requires a valid certificate on your server. This is the mode Cloudflare recommends for best security.
For a WordPress site that you want to keep secure, Full (strict) is the right choice.
Step 1. Create an origin certificate
To use Full (strict) mode you need a valid certificate on your server. Cloudflare makes this easy with an origin certificate, which you can generate free in the dashboard:
- Log in to Cloudflare and select your site.
- Open the SSL/TLS section and go to Origin Server.
- Click Create Certificate and accept the defaults.
- Copy the certificate and private key that Cloudflare generates.
Step 2. Install the certificate on your server
Paste the certificate and key into your web host’s control panel. Most hosts have an SSL section where you can add a custom certificate. After saving, your server will serve HTTPS directly. If you prefer, you can use a free certificate from Let’s Encrypt instead, which serves the same purpose.
Step 3. Set the encryption mode to Full (strict)
- In Cloudflare, open SSL/TLS and go to Overview.
- Choose Full (strict) from the encryption mode options.
- Cloudflare will now encrypt traffic end to end.
Step 4. Force HTTPS
Instead of the old page rules, Cloudflare now offers an Always Use HTTPS setting:
- In the SSL/TLS section, go to Edge Certificates.
- Find Always Use HTTPS and switch it on.
- Also enable Automatic HTTPS Rewrites to fix mixed content, where some resources still load over HTTP.
Step 5. Update WordPress
Install the official Cloudflare WordPress plugin from the WordPress repository. It handles redirects and helps prevent the classic redirect loop problem. Then, in WordPress settings, make sure your site addresses use https, since your origin now serves HTTPS directly.
Why this is better than the old Flexible approach
With Flexible SSL, traffic between Cloudflare and your server stayed unencrypted, and the setup often needed a separate plugin to stop redirect loops. Full (strict) with an origin certificate encrypts the entire path, keeps the browser padlock green, and requires no workaround plugins. It is cleaner, more secure and the current recommended practice.
Conclusion
Setting up SSL on WordPress with Cloudflare in 2026 is straightforward. Generate a free origin certificate, switch to Full (strict), turn on Always Use HTTPS, and install the official Cloudflare plugin. Your site gets modern, end to end encryption without the fragility of the old Flexible SSL workaround.