Back to Checks
cloudflare

Universal SSL is enabled

zone_universal_ssl_enabled
Service: zoneSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Zone

Cloudflare zones are assessed for Universal SSL configuration by checking if it is enabled to provide free SSL/TLS certificates for the domain and its subdomains, enabling secure HTTPS connections.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without Universal SSL, visitors cannot establish HTTPS connections to your site.

  • Confidentiality: all traffic is unencrypted and vulnerable to interception and eavesdropping
  • Integrity: HTTP responses can be modified in transit by attackers (content injection, malware)
  • Trust: browsers display security warnings degrading user trust and experience

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_universal_ssl_enabled

Recommendation

Enable Universal SSL to provide HTTPS capability for your domain.

  • Universal SSL is the foundation for transport security
  • Required before implementing HSTS or other HTTPS-dependent features
  • Cloudflare automatically renews certificates before expiration
  • Consider upgrading to Advanced Certificate Manager for additional control

Remediation

Terraform

# Note: Universal SSL is enabled by default on Cloudflare
# To explicitly manage SSL settings, use zone_settings_override
resource "cloudflare_zone_settings_override" "ssl_settings" {
  zone_id = "<ZONE_ID>"
  settings {
    ssl = "full" # Critical: enables SSL/TLS encryption
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to SSL/TLS > Edge Certificates
3Scroll to Universal SSL
4Ensure the status shows Active
5If disabled, click Enable Universal SSL
6Wait for certificate issuance (typically within 24 hours for new domains)

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_universal_ssl_enabled(Check):
    """Ensure that Universal SSL is enabled for Cloudflare zones.

    Universal SSL provides free SSL/TLS certificates for the domain and its
    subdomains, enabling secure HTTPS connections without requiring manual
    certificate management. This feature automatically provisions and renews
    certificates, ensuring continuous protection for web traffic.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the Universal SSL enabled check.

        Iterates through all Cloudflare zones and verifies that Universal SSL
        is enabled. Universal SSL provides automatic certificate provisioning
        and management for the zone and its subdomains.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if Universal
            SSL is enabled, or FAIL status if it is disabled for the zone.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            if zone.settings.universal_ssl_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Universal SSL is enabled for zone {zone.name}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Universal SSL is not enabled for zone {zone.name}."
                )
            findings.append(report)
        return findings

References