SSL Toolkit Logo
Tools Features Compare FAQ Login

Cloudflare SSL Checker

Check Cloudflare SSL configuration

About Cloudflare SSL Checker

The Cloudflare SSL Checker verifies whether a domain is behind Cloudflare and analyzes its SSL/TLS configuration. It detects the encryption mode (Flexible, Full, or Full Strict), checks edge certificate status, identifies TLS version support, and inspects Cloudflare-specific HTTP headers like CF-Ray and Server headers.

Use Cases

  • •Verify your Cloudflare SSL/TLS encryption mode is set correctly
  • •Confirm Cloudflare proxy is active for your domain
  • •Troubleshoot SSL misconfigurations behind Cloudflare
  • •Audit edge certificate issuer and nameserver configuration

How to Use

  • •Enter the domain name you want to check (e.g., example.com)
  • •Click "Run" to start the Cloudflare SSL analysis
  • •Review the results including Cloudflare status, certificate issuer, and detected HTTP headers

Frequently Asked Questions

The checker identifies whether your domain uses Cloudflare Flexbile, Full, or Full Strict SSL mode based on the edge certificate and origin server handshake. It analyzes the CF-Ray header, Server header, and certificate chain to determine the encryption mode.
Cloudflare acts as a reverse proxy, terminating SSL at the edge and optionally re-encrypting traffic to your origin server. Flexible mode encrypts browser-to-Cloudflare only. Full mode encrypts both legs but allows any origin certificate. Full Strict requires a valid origin certificate.
If your domain does not show as behind Cloudflare, the DNS may not be proxied through Cloudflare, or the Cloudflare proxy may be temporarily disabled. Check that your nameservers point to Cloudflare and that the orange cloud icon is enabled in your Cloudflare dashboard.
Look for agreement between independent signals rather than one. A Cloudflare issuer on the certificate, a CF-Ray header in the response, Cloudflare nameservers, and resolved addresses inside their published ranges are four separate indicators, and this page reports which fired. Any single one can be misleading — nameservers may be Cloudflare while traffic goes direct, which is exactly what a partial migration looks like.
Because DNS delegation and web proxying are configured separately in Cloudflare, and many setups run them independently. Orange-clouded hostnames proxy all traffic while grey-clouded ones resolve through Cloudflare's nameservers but connect straight to the origin. That second state explains Cloudflare NS records with no Cloudflare edge, and it is why the page reports the methods individually instead of collapsing them into one verdict.
Usually not visibly, because Cloudflare terminates TLS at its edge and presents a certificate of its own. Visitors see Cloudflare's certificate rather than yours, which is why the issuer signal can name them even when your origin holds a certificate from a public CA. It also means origin-only misconfigurations are invisible from outside — check the origin directly, from a host that bypasses the proxy.
It is a request identifier Cloudflare adds to every response through its network, carrying the data-centre code, the internal identifier and the timestamp. It matters as a signal because it appears only on responses that genuinely traversed their edge, and operationally it is the single most useful field when asking Cloudflare support about a specific request, since it lets them find that exact edge request in their logs.
Possible, and it comes down to partial proxying or an unusual configuration. If the hostname is grey-clouded while other records on the domain are proxied, all four signals can be absent even though the domain partly uses Cloudflare. Test a specific proxied subdomain rather than the apex, and remember that origin-only checks are the reliable way to see what your own server is doing.

How Detection Works

There is no single authoritative signal for whether a site sits behind Cloudflare, so this page gathers four independent ones and reports which fired. Any single method can be fooled — a hostname can carry Cloudflare nameservers while being served directly, and an IP in Cloudflare's range can front something else entirely.

  1. 1Certificate issuer. Cloudflare issues its own edge certificates, so an issuer naming Cloudflare is a strong signal — though not conclusive, since an origin certificate can be issued by a different provider entirely.
  2. 2HTTP response headers. The CF-Ray identifier and a Server header naming Cloudflare both appear on proxied responses. Absent headers are recorded rather than assumed, since a HEAD request may be rejected where a GET succeeds.
  3. 3Authoritative nameservers. Cloudflare's own names in the NS records mean DNS is delegated through them. This can be true while the web traffic bypasses Cloudflare entirely, which is the usual shape of a partial migration.
  4. 4Resolved IP ranges. Each resolved address is matched against Cloudflare's published ranges. Matching means the traffic terminates in their network; it does not prove the application is proxied through it.

Methods that could not be checked are listed with their error rather than dropped, because a missing signal and an absent one mean different things. Two or more methods agreeing is the basis for a confident verdict; one alone is worth confirming another way.

Tips & Best Practices

  • •Choose the right Cloudflare SSL mode for your security requirements
  • •Verify Cloudflare SSL configuration matches your origin server setup
  • •Use Cloudflare Origin Certificate for secure origin connections
  • •Monitor Cloudflare SSL status for certificate expiry and issues

Technical Details

Modes: Off, Flexible, Full, Full (Strict), Strict (SPA)
Certificates: Universal SSL, dedicated certificates, Origin certificates
Edge: Cloudflare edge SSL termination and origin connections
Output: Cloudflare SSL configuration analysis and recommendations

Related Tools

SSL Certificate Checker HSTS Preload Checker Security Header Analyzer DNS Propagation Checker Certificate Expiry Calendar ECDSA Key Strength Analyzer Certificate Inventory