Check ID: zone_tls_1_3_enabled
Provider: Cloudflare
Service: zone
Severity: MEDIUM
Categories: encryption
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for TLS 1.3 configuration by checking if it is enabled to benefit from improved security through simplified cipher suites and faster handshakes with zero round-trip time resumption.

​
Risk

Without TLS 1.3, connections use older TLS versions with less secure characteristics.
  • Confidentiality: legacy TLS versions have more complex cipher negotiations that may expose weaknesses
  • Integrity: older protocols lack protection against downgrade attacks that TLS 1.3 provides
  • Performance: slower handshakes impact user experience and increase latency

​
Recommendation

Enable TLS 1.3 to provide the most secure and efficient TLS connections.
  • All modern browsers support TLS 1.3 ensuring broad compatibility
  • TLS 1.3 removes obsolete cryptographic algorithms
  • Zero round-trip time (0-RTT) resumption improves performance
  • Combine with minimum TLS version set to 1.2 or higher

​
Remediation

# Enable TLS 1.3 for improved security and performance
resource "cloudflare_zone_settings_override" "tls_settings" {
  zone_id = "<ZONE_ID>"
  settings {
    tls_1_3 = "on" # Critical: enables most secure TLS version with faster handshakes
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_tls_1_3_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks