Cloudflare (Web Performance & Security)

Mandatory Settings

SSL-TLS

Edge Certificates

Always Use HTTPS

Redirect all requests with scheme “http” to “https”. This applies to all http requests to the zone.

Mandatory: On

HTTP Strict Transport Security (HSTS)

Enforce web security policy for your website.

Mandatory: On with the following settings:

Enable HSTS (Strict-Transport-Security)
Serve HSTS headers with all HTTPS requests

Mandatory: On

Max Age Header (max-age)
Specify the duration HSTS headers are cached in browsers

Mandatory: 6 Months

No-Sniff Header
Send the “X-Content-Type-Options: nosniff” header to prevent Internet Explorer and Google Chrome from MIME-sniffing away from the declared Content-Type.

Mandatory: On

Minimum TLS Version

Only allow HTTPS connections from visitors that support the selected TLS protocol version or newer.

Mandatory: 1.2

Opportunistic Encryption

Opportunistic Encryption allows browsers to benefit from the improved performance of HTTP/2 by letting them know that your site is available over an encrypted connection. Browsers will continue to show “http” in the address bar, not “https”.

Mandatory: On

TLS 1.3

Enable the latest version of the TLS protocol for improved security and performance.

Mandatory: On

Automatic HTTPS Rewrites

Automatic HTTPS Rewrites helps fix mixed content by changing “http” to “https” for all resources or links on your web site that can be served with HTTPS.

Mandatory: On