Why Cloudflare sees your encrypted traffic

Behind Cloudflare's proxy, HTTPS ends at Cloudflare's edge, which decrypts each request. What that exposes, which options change it, and how to check.

Updated By enum

When a site uses Cloudflare's proxy, the visitor's HTTPS connection ends at Cloudflare, not at the site's own server. Cloudflare decrypts each request, applies caching and security rules, and then opens a second connection to the origin. The padlock in the browser therefore means "encrypted between you and Cloudflare". It does not mean the connection is encrypted end to end to the site's server.

How does a request travel through Cloudflare?

Each DNS record in a Cloudflare zone has a proxy status. A proxied record shows as an orange cloud in the dashboard, and proxying is on by default when a domain is added through the dashboard. For a proxied record, Cloudflare answers DNS queries with its own anycast IP addresses instead of the origin's address. The browser then connects to a Cloudflare data center.

Cloudflare describes two connections: visitor to Cloudflare, and Cloudflare to the origin server. On the first connection, the browser sees an edge certificate, which Cloudflare presents to visitors on behalf of the domain. Cloudflare then applies the zone's configuration, such as WAF rules, caching and redirect rules, to the decrypted request.

What do the SSL/TLS encryption modes change?

The encryption mode controls only the second connection, from Cloudflare to the origin. Cloudflare documents these modes:

  • Off: no encryption on either connection.
  • Flexible: the visitor connection can use HTTPS, but Cloudflare connects to the origin over plain HTTP.
  • Full: Cloudflare connects to the origin with the same protocol the visitor used, without validating the origin's certificate.
  • Full (strict): like Full, but Cloudflare validates the origin certificate.
  • Strict (SSL-Only Origin Pull): Cloudflare always connects to the origin over HTTPS with certificate validation.

Cloudflare is rolling out Automatic SSL/TLS, which picks a mode based on what the origin supports. In every mode, the request is in plain text inside Cloudflare between the two connections. A stricter mode protects the path from Cloudflare to the origin; it does not remove Cloudflare from the path.

Key point: on a proxied Cloudflare hostname, the TLS connection you see in the browser ends at Cloudflare. The encryption mode decides how traffic travels onward, not whether Cloudflare can read it.

What can Cloudflare see on a proxied site?

Because the edge terminates TLS, Cloudflare handles these in plain text for each request:

  • the full URL, including path and query string
  • request headers, including cookies and authorization headers
  • request bodies, such as login forms, form submissions and API payloads
  • the response the origin sends back
  • the visitor's IP address

Cloudflare forwards the visitor's IP address to the origin in a CF-Connecting-IP header. Cloudflare's own overview lists TLS handling among the benefits of its reverse proxy: it "can be configured to decrypt all incoming requests and encrypt all outgoing responses".

Which Cloudflare options change this?

DNS-only records (grey cloud). For a DNS-only record, Cloudflare answers with the origin's real IP address and does not route HTTP or HTTPS traffic through its network. The visitor's TLS connection then ends at the origin. Cloudflare still answers DNS queries but does not carry the web traffic. The tradeoff, per the same page: the origin IP is exposed and the proxy protections no longer apply.

Keyless SSL. Keyless SSL, an Enterprise add-on, lets a customer keep the TLS private key on its own key server. Cloudflare's servers contact that key server during the handshake to set up new TLS sessions. The documentation still describes this as terminating TLS at Cloudflare's edge, and all Keyless SSL hostnames must be proxied. So Keyless SSL changes where the private key is stored, not where the traffic is decrypted.

Spectrum with TLS passthrough. Spectrum is a TCP and UDP proxy, with custom TCP/UDP applications requiring an Enterprise plan. For TCP applications with Edge TLS Termination set to off, Cloudflare's documentation says Spectrum proxies connections to the origin without decrypting them, and the visitor sees the origin's certificate. HTTP/HTTPS applications still go through Cloudflare's normal proxy pipeline.

Data Localization Suite and Regional Services. The Data Localization Suite, an Enterprise add-on, lets customers choose where Cloudflare inspects and stores data. With Regional Services, TLS termination only occurs inside the configured region. Cloudflare's example: a hostname set to the EU receives a US visitor's request at a US data center, forwards it encrypted, and decrypts it in an EU data center. This controls where decryption happens, and the data centers are still Cloudflare's.

Why does Cloudflare's jurisdiction matter if decryption happens in the EU?

Cloudflare, Inc. is incorporated in Delaware and has its principal executive offices in San Francisco, according to its annual report filed with the US Securities and Exchange Commission. It is a US company.

The US CLOUD Act added 18 U.S.C. § 2713. It requires providers of electronic communication service or remote computing service to disclose data in their "possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States." The test in the statute is control, not location. Regional decryption changes the location of processing; it does not change which company operates it. Whether a specific service falls under those definitions is a legal question for each case, and this guide is not legal advice.

How does staysin.eu detect Cloudflare?

staysin.eu matches Cloudflare in three rows of a check:

  • CDN: a cf-ray response header, a Server header containing cloudflare, or a CNAME that points to a Cloudflare hostname.
  • Provider: the site's IP address belongs to Cloudflare's networks, AS13335 or AS209242.
  • DNS: the domain's nameservers have cloudflare in their hostname.

Cloudflare is classified with country US and a non-EU verdict. On a proxied site, the Provider row shows Cloudflare, because the public IP address is Cloudflare's and the origin is hidden behind it. The current classification is on the Cloudflare provider page, and the methodology explains how verdicts are scored.

How can I check whether a site uses Cloudflare myself?

Look at the response headers:

curl -sI https://example.com

A proxied Cloudflare site returns a line such as server: cloudflare and a cf-ray header. The three letters at the end of the Ray ID name the Cloudflare data center that handled the request.

Then check the nameservers:

dig +short NS example.com

Cloudflare's standard nameservers follow the pattern <name>.ns.cloudflare.com. Cloudflare nameservers alone do not mean the web traffic is proxied. A site can use Cloudflare DNS with DNS-only records, and then the headers above will not appear.

Or run the check on staysin.eu: staysin.eu/example.com shows each row with its evidence, and any domain can be checked from the start page. Aggregate results are on the stats page.

Sources