[ Web Proxy ]

Viewing: https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/ssl-only-origin-pull/

Strict (SSL-Only Origin Pull) - SSL/TLS encryption modes Cloudflare SSL/TLS docsSkip to content

[]DocsDirectory API SDKs Changelog

SearchCtrlK

SSL/TLS

Overview
Concepts
Get started
Edge certificates
- Overview
- Universal SSL
  Overview
  Enable Universal SSL certificates
  Disable Universal SSL certificates
  Alerts
  Limitations
  Troubleshooting
- Advanced certificates
  Overview
  Manage advanced certificates
  API commands
- Custom certificates
  Overview
  Manage custom certificates
  Renewal and expiration
  Bundle methodologies
  Remove key file password
  Troubleshooting
- Enforce HTTPS connections
- Domain control validation (DCV)
  Overview
  Methods
  Overview
  Delegated
  TXT
  HTTP
  Validation backoff schedule
  Domain control validation flow
  Troubleshooting
- Geo Key ManagerBeta
  Overview
  Setup
  Supported options
- Add CAA records
- Staging environmentBeta
- Backup certificates
- ECH ProtocolBeta
- Additional options
  Cipher suites
  About
  Customize cipher suites
  Overview
  Use the dashboard
  Use the API
  Security levels
  Compliance standards
  Supported cipher suites
  Troubleshooting
  Certificate Transparency Monitoring
  HTTP Strict Transport Security (HSTS)
  Certificate Signing Requests (CSRs)
  TLS 1.3
  Minimum TLS Version
  Automatic HTTPS Rewrites
  Total TLS
  Overview
  Enable
  Error messages
  Always Use HTTPS
  Opportunistic Encryption
Origin server
- Encryption modes
  Overview
  Off (no encryption)
  Flexible
  Full
  Full (strict)
  Strict (SSL-Only Origin Pull)
- Automatic key exchange to origins
- SSL/TLS RecommenderDeprecated
- Cloudflare origin CA
  Setup
  Troubleshooting
- Authenticated Origin Pulls (mTLS)
  Overview
  About
  AWS integration
  Setup
  Global
  Zone-level
  Per-hostname
  Manage certificates
  Rollback
- Custom Origin Trust Store
- Cipher suites
Client certificates (mTLS)
Cloudflare for SaaS
Keyless SSL
- Overview
- Get started
  Cloudflare Tunnel
  Public DNS
  Run with Docker
- Hardware security modules
  Overview
  Configuration
  AWS cloud HSM
  Azure Dedicated HSM
  Azure Managed HSM
  Entrust nShield Connect
  Fortanix DSM
  Google Cloud HSM
  IBM Cloud HSM
  SoftHSMv2
- Upgrade your key server
- Reference
  High availability
  Scaling and benchmarking
  Key server metrics
  Keyless delegation
- Glossary
- Troubleshooting
Post-quantum
Reference
Troubleshooting
FAQ
Changelog
Agent resources

Home
/SSL/TLS
/…
Origin server
/Encryption modes
/Strict (SSL-Only Origin Pull)

Strict (SSL-Only Origin Pull)

Last updated Jul 9, 2026Copy as MarkdownView as MarkdownAgent setup

OverviewUse whenRequired setupProcessLimitations

Note

This method is only available for Enterprise zones.

When you set your encryption mode to Strict (SSL-Only Origin Pull), connections to the origin will always be made using SSL/TLS, regardless of the scheme requested by the visitor.

The certificate presented by the origin will be validated the same as with Full (strict) mode.

Use when

You want the most secure configuration available for your origin, you are an Enterprise customer, and you meet the requirements for Full (strict) mode.

Required setup

The setup is generally the same as Full (strict) mode, but you select Strict (SSL-Only Origin Pull) for your encryption mode.

Note

In addition to Strict (SSL-Only Origin Pull) encryption, you can also set up Authenticated Origin Pulls to ensure all requests to your origin are evaluated before receiving a response.

Process

To change your encryption mode in the dashboard:

In the Cloudflare dashboard, go to the SSL/TLS Overview page.
Go to Overview ↗
Choose an encryption mode.

To adjust your encryption mode with the API, send a PATCH request with ssl as the setting name in the URI path, and the value parameter set to your desired setting (off, flexible, full, strict, or origin_pull).

Limitations

Depending on your origin configuration, you may have to adjust settings to avoid Mixed Content errors or redirect loops.

PreviousFull (strict)NextAutomatic key exchange to origins

Was this helpful?

YesNo

Edit page Report issue

Strict (SSL-Only Origin Pull)

Use when

Required setup

Process

Limitations

On this page