Check ID: zone_universal_ssl_enabled
Provider: Cloudflare
Service: zone
Severity: HIGH
Categories: encryption
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Universal SSL configuration by checking if it is enabled to provide free SSL/TLS certificates for the domain and its subdomains, enabling secure HTTPS connections.

​
Risk

Without Universal SSL, visitors cannot establish HTTPS connections to your site.
  • Confidentiality: all traffic is unencrypted and vulnerable to interception and eavesdropping
  • Integrity: HTTP responses can be modified in transit by attackers (content injection, malware)
  • Trust: browsers display security warnings degrading user trust and experience

​
Recommendation

Enable Universal SSL to provide HTTPS capability for your domain.
  • Universal SSL is the foundation for transport security
  • Required before implementing HSTS or other HTTPS-dependent features
  • Cloudflare automatically renews certificates before expiration
  • Consider upgrading to Advanced Certificate Manager for additional control

​
Remediation

# Note: Universal SSL is enabled by default on Cloudflare
# To explicitly manage SSL settings, use zone_settings_override
resource "cloudflare_zone_settings_override" "ssl_settings" {
  zone_id = "<ZONE_ID>"
  settings {
    ssl = "full" # Critical: enables SSL/TLS encryption
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_universal_ssl_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks