Automatically Secure: how we upgraded 6,000,000 domains by default to get ready for the Quantum Future

Cloudflare reports that Automatic SSL/TLS, which scans origin servers and upgrades domains to the strongest encryption mode they support by default, has strengthened security for more than 6 million domains over the past year. Since late 2024, this automatic approach has moved millions of sites to HTTPS by default, with a notable shift in origin-facing connections: plaintext origin-bound connections have declined by about 7–8%, and TLS 1.3 now accounts for the majority of encrypted origin traffic, close to 60%.

The system originally relied on the SSL/TLS Recommender to suggest safer modes, but was found to be underutilised, with only around 30% of recommendations followed; hence, Cloudflare integrated these upgrades by default. By January 2025, most domains had been onboarded, and the company notes a near 180-degree shift from plaintext to encrypted communications, followed by a renewed uptick in encrypted traffic in the past two months as origins are further upgraded.

Looking ahead, Cloudflare plans to expand Automatic SSL/TLS to provide ad-hoc scans, enhanced error surfacing, and post-quantum readiness, with further improvements expected by June 2026.