WARP modes

The WARP client has several modes to better suit different connection needs.

Formerly known as 1.1.1.1.

In DNS only mode, WARP routes only DNS queries through Cloudflare's 1.1.1.1 resolver and does not tunnel device traffic. DNS queries are always encrypted: DNS only (HTTPS) uses DNS-over-HTTPS (DoH), and DNS only (TLS) uses DNS-over-TLS (DoT).

Refer to 1.1.1.1 resolver to learn more about DNS encryption.

Formerly known as 1.1.1.1 with WARP.

The WARP application uses MASQUE to encrypt and send traffic from your device directly to Cloudflare's global network. This ensures Internet traffic between your device and the Internet is secure and private, while also preventing third parties from accessing your traffic. All traffic1 tunneled over the MASQUE connection is encrypted using post-quantum cryptography to protect against harvest-now-decrypt-later attacks .

This mode is available in three flavors:

• Traffic and DNS (UDP) All device traffic is routed through WARP, and DNS queries use UDP inside the tunnel.
• Traffic and DNS (TLS) All device traffic is routed through WARP, and DNS queries are encrypted via DNS-over-TLS (DoT).
• Traffic and DNS (HTTPS) All device traffic is routed through WARP, and DNS queries are encrypted via DNS-over-HTTPS (DoH).

If the site you are visiting is already a Cloudflare customer, the content is immediately sent to your device. If not, Cloudflare uses its global network of data centers to devise the shortest path to the site. For more information, refer to our blog post Introducing WARP: Fixing Mobile Internet Performance and Security .

In Traffic only mode, all device traffic is routed through WARP, but DNS resolution remains managed by the device operating system.

Currently, this mode is available on desktop clients only. When WARP is configured as a local proxy, only the applications that you configure to use the proxy (HTTPS or SOCKS5) will have their traffic sent through WARP. This allows you to pick and choose which traffic is encrypted for example, your web browser or a specific application. Everything else will not be encrypted and will be sent over a regular Internet connection.

Because this feature restricts WARP to just applications configured to use the local proxy, leaving all other traffic over the Internet unencrypted by default, we have hidden it in the Advanced menu. To turn it on:

1. Navigate to Preferences > Advanced and select Configure Proxy.
2. On the window that opens, check the box and configure the port you want to listen on.

This will enable the Local proxy option in the WARP Settings menu.

If you enable FIPS compliance for TLS decryption, you must disable QUIC in your users' browsers. Otherwise, HTTP/3 traffic will bypass inspection by the WARP client.

While WARP can take advantage of the many Cloudflare data centers around the world to give you a more private and robust connection, WARP+ Unlimited subscribers get access to a larger network. More cities to connect to means you are likely to be closer to a Cloudflare data center, which can reduce latency and improve your browsing speed.

WARP+ Unlimited is a paid, monthly subscription that can be purchased via the Apple App Store or Google Play Store.

To subscribe to WARP+ Unlimited:

1. On an iOS or Android device, launch the 1.1.1.1: Faster Internet app.
2. Select Settings > Upgrade to WARP+. A dialog will appear with the subscription price.
3. To confirm your subscription, select Subscribe to WARP+ Unlimited. All payments are handled by the Apple/Google app store, and the payment information associated with your Apple/Google account will be charged for these subscriptions.

WARP+ Unlimited is now active on this device. You can use your license key on up to five devices.

1. Post-quantum cryptography requires the following minimum WARP versions:
   Android: 2.4.3
   iOS: 1.11.1
   Windows, macOS, and Linux: 2025.6.1335.0