Cloudflare Cipher suite recommendations: A Guide for Website Owners
Learn how Cloudflare’s Modern, Compatible, and Legacy cipher suite recommendations affect browser support, TLS versions, and your setting choice.
Facts that can change should include a source and check date. Benchmark claims should state the plan, region, method, and test period.
Cloudflare cipher suite recommendations help you choose how much client compatibility to allow at the Cloudflare edge. Choose Modern when your site can require current browsers and devices. Consider Compatible when broader support matters while retaining TLS 1.2–1.3. Use Legacy when the broadest compatibility is necessary; Cloudflare documents it as the default and supports TLS 1.0–1.3.
Cloudflare’s three options#
| Setting | TLS versions | Documented behavior |
|---|---|---|
| Modern | TLS 1.2–1.3 | Uses forward-secret suites with authenticated encryption and limits compatibility to modern devices and browsers. |
| Compatible | TLS 1.2–1.3 | Provides broader compatibility than Modern with somewhat weaker security. |
| Legacy | TLS 1.0–1.3 | Provides the broadest compatibility and the weakest security of the three options. Cloudflare lists it as the default. |
The choice is therefore a trade-off between restricting older clients and supporting them. Modern is appropriate when older browsers, devices, or other TLS clients are outside your audience. Compatible is a middle option when wider client support is needed but TLS 1.2–1.3 should remain the supported range. Legacy is a compatibility setting, not automatically the preferred security setting.
What the setting covers#
Cipher suites describe the encryption options negotiated for a TLS connection. In Cloudflare’s documentation, these recommendations concern the connection between a visitor and the Cloudflare edge.
Cloudflare’s broader SSL/TLS documentation distinguishes that connection from the one between Cloudflare and your origin server. An edge certificate is used for visitor-to-Cloudflare traffic, while an origin certificate is used for Cloudflare-to-server traffic. Keep those two connections separate when reviewing your configuration: changing an edge cipher suite does not replace a review of the origin-side TLS settings.
Check related settings before changing it#
Cloudflare advises reviewing related SSL/TLS settings before selecting Modern or Compatible. Cipher suites interact with the configured minimum TLS version and with TLS 1.3, so consider those settings together rather than choosing a suite level in isolation.
Cloudflare also documents cipher-suite customization at the zone or hostname level. That allows the setting to be scoped where client requirements differ, subject to Cloudflare’s available configuration options.
Before making a change, identify the browsers, devices, and other TLS clients that need access to the site. Then compare that client list with the documented TLS range and compatibility of the selected option. If you move away from Legacy, test the site from representative clients that matter to your audience; a test of your own client mix is evidence about that site, not a universal compatibility guarantee for Cloudflare or other hosting providers.
Sources
- Cloudflare: Cipher suite recommendations Checked 2026-10-16
- Cloudflare SSL/TLS documentation Checked 2026-10-16