How to Fix Broken SSL and Mixed Content Warnings with Cloudflare
Modern web browsers (Google Chrome, Firefox, Safari) immediately penalize unencrypted websites. If your website lacks an active SSL/TLS certificate or serves mixed HTTP assets, visitors encounter prominent "Not Secure" security warnings, and Google Search penalizes your ranking. While Cloudflare provides free SSL certificates, improper configuration frequently triggers the notorious ERR_TOO_MANY_REDIRECTS loop or partial green padlock errors.
Strategic Executive Summary
- Core Insight: Setting Cloudflare SSL to "Flexible" when your origin web server is configured to force HTTPS causes an infinite redirect loop. Always use "Full" or "Full (Strict)".
- Production Quality: Battle-tested engineering techniques designed specifically for Nepal's network infrastructure and business environment.
- Direct Implementation: Copy-paste ready code architectures with security safeguards against race conditions, data corruption, and unauthorized access.
Table of Contents
1. Understanding Cloudflare SSL Encryption Modes
- Flexible Mode: Traffic between user browser and Cloudflare is encrypted (HTTPS), but traffic between Cloudflare and your origin cPanel server is sent unencrypted (HTTP on port 80). If your WordPress site has HTTPS forced, the server redirects Cloudflare back to HTTPS, creating an endless redirect loop.
- Full / Full (Strict) Mode: Traffic is fully encrypted end-to-end (browser to Cloudflare, and Cloudflare to origin server over port 443). This is the only configuration that guarantees true end-to-end security.
2. Installing a 15-Year Cloudflare Origin CA Certificate on cPanel
Instead of renewing 90-day Let's Encrypt certificates manually:
- In Cloudflare Dashboard, navigate to SSL/TLS > Origin Server.
- Click Create Certificate (valid for 15 years for your domain and wildcard
*.yourdomain.com). - Copy the generated Certificate and Private Key.
- Open cPanel > SSL/TLS > Install and Manage SSL for your site (HTTPS).
- Select your domain, paste the Certificate and Private Key, and click Install Certificate.
- In Cloudflare, switch your SSL mode to Full (Strict).
3. Fixing Mixed Content (Insecure Images & Fonts)
Mixed content occurs when an HTTPS page loads sub-resources (such as images, custom CSS, or scripts) using hardcoded http:// URLs. The browser blocks the insecure resources or removes the secure padlock.
- Automated Header Upgrade: Add the Content Security Policy upgrade directive to your
.htaccess:
<IfModule mod_headers.c>
Header always set Content-Security-Policy "upgrade-insecure-requests;"
</IfModule>- Cloudflare Automatic HTTPS Rewrites: Navigate to Cloudflare SSL/TLS > Edge Certificates and enable "Automatic HTTPS Rewrites" and "Always Use HTTPS".
- Database Search-Replace for WordPress: Run WP-CLI to update legacy hardcoded URLs across all database tables:
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tablesOfficial Technical Documentation & Reference Sources:
