Area: Website and certificates

Cloudflare

With your Cloudflare zone connected (read-only): encryption to the origin, forced HTTPS, minimum TLS, DNSSEC, security level and records without the proxy.

What it can report

Open each one to see what it means and how to fix it.

Cloudflare SSL off or flexible

What it means

Cloudflare's SSL mode is off or flexible: visitors see HTTPS, but the hop from Cloudflare to your server is not encrypted (or there is no TLS at all).

What could happen

Anyone on the path between Cloudflare and your origin can read or change traffic: passwords, cookies and form data included.

How an attacker would use it

An attacker on the same network as your hosting reads session cookies between Cloudflare and the server, then reuses them to enter the admin area.

How to fix it

Install a valid certificate on your origin (Let's Encrypt is enough).
In the Cloudflare dashboard, go to SSL/TLS and set the mode to Full (strict).
Confirm the site still loads over HTTPS after the change.

How to check it's fixed

Ward reads the SSL setting at each scan. The finding disappears when the mode is Full or Full (strict).

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

HTTPS not forced on Cloudflare

What it means

Always Use HTTPS is off, so visitors can still open your site over plain HTTP.

What could happen

Someone who lands on http:// can be watched or redirected before Cloudflare upgrades them. Bookmarks and old links often still use HTTP.

How an attacker would use it

A visitor follows an old unencrypted link. On an open Wi-Fi, an attacker injects a fake login page before the browser ever reaches HTTPS.

How to fix it

In the Cloudflare dashboard, go to SSL/TLS → Edge Certificates.
Turn on Always Use HTTPS.
Optionally enable Automatic HTTPS Rewrites for mixed content on the page.

How to check it's fixed

Ward reads the Always Use HTTPS setting at each scan. The finding disappears when it is on.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Cloudflare minimum TLS too low

What it means

Cloudflare still accepts TLS versions below 1.2 for visitors. Those versions are obsolete and weak.

What could happen

An attacker who can influence the connection may force an old TLS version and weaken or break the encryption.

How an attacker would use it

On a network the attacker controls, they downgrade the handshake to TLS 1.0 and try known attacks against that version.

How to fix it

In the Cloudflare dashboard, go to SSL/TLS → Edge Certificates.
Set Minimum TLS Version to 1.2 or 1.3.
Check that critical clients (old payment terminals, etc.) still work; almost all modern browsers are fine.

How to check it's fixed

Ward reads the minimum TLS version at each scan. The finding disappears when it is 1.2 or higher.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Origin IP exposed without Cloudflare proxy

What it means

DNS records for your domain or www point to the server without Cloudflare's proxy (grey cloud). The real IP is public.

What could happen

Attackers can hit your origin directly and bypass Cloudflare's firewall, DDoS protection and bot filters.

How an attacker would use it

They look up the A record, attack the origin IP with a flood or exploit, and your Cloudflare rules never see the traffic.

How to fix it

In the Cloudflare dashboard, go to DNS.
Turn the proxy on (orange cloud) for the A, AAAA and CNAME records of the domain and www.
Restrict the origin firewall to Cloudflare IP ranges if your host allows it.

How to check it's fixed

Ward lists DNS records without the proxy at each scan. The finding disappears when apex and www are proxied.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

DNSSEC disabled on Cloudflare

What it means

DNSSEC isn't enabled on this Cloudflare zone. Resolvers can't verify that DNS answers really come from you.

What could happen

Without DNSSEC, a poisoned resolver or path can send visitors to a fake IP while the domain name looks correct.

How an attacker would use it

On a compromised network path, forged DNS answers send your customers to a phishing site that looks like yours.

How to fix it

In the Cloudflare dashboard, go to DNS → Settings.
Enable DNSSEC.
If Cloudflare shows a DS record, add it at your domain registrar.

How to check it's fixed

Ward reads the DNSSEC status at each scan. The finding disappears when DNSSEC is active (or pending while the DS propagates).

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Cloudflare security level too low

What it means

Cloudflare's security level is essentially off or low, so almost no visitor is challenged.

What could happen

Obvious automated attacks and scrapers face little friction. Raising the level helps without blocking normal users.

How an attacker would use it

A cheap botnet hammers login and form endpoints; with security level low, Cloudflare rarely presents a challenge.

How to fix it

In the Cloudflare dashboard, go to Security → Settings.
Set Security Level to Medium (or High if you are under attack).
Watch the firewall events for a day in case a legitimate integration gets challenged.

How to check it's fixed

Ward reads the security level at each scan. The finding disappears when it is medium or higher.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.