For a proxied site, visitors' connections are encrypted at the edge. The SSL/TLS mode sets how the edge then talks to your server.
| Mode | Edge to server | Use when |
|---|---|---|
| Off | Plain HTTP only, visitors too | Never for a live site |
| Flexible | Plain HTTP | The server has no certificate at all |
| Full | Encrypted, any certificate | The server has a self-signed certificate |
| Full (Strict) | Encrypted, valid certificate required | The server has a proper certificate — every phas plan does |
Sites hosted with phas
Use Full (Strict). Plans issue and renew a valid certificate for every attached domain, so the connection is encrypted end to end and verified at both hops.
Sites hosted elsewhere
Pick the row that matches what the server has. If in doubt, start with Full and move to Full (Strict) once a certificate is installed.
"Too many redirects"
The classic symptom of Flexible on a server that forces HTTPS: the edge asks the server over HTTP, the server redirects to HTTPS, the edge asks over HTTP again, and round it goes. Change the mode to Full or Full (Strict).
HTTPS enforcement
The Security card also has switches to always use HTTPS and to rewrite insecure links in pages. Both are safe on for any site that has a certificate, which includes every site on a phas plan.