Cloudflare has announced the complete shutdown of all HTTP connections to its API service, now accepting only secure HTTPS connections for api.cloudflare.com. This security enhancement prevents unencrypted API requests from being transmitted, eliminating the risk of sensitive information exposure in cleartext traffic.

“Starting today, any unencrypted connection to api.cloudflare.com will be completely rejected,” Cloudflare stated in Thursday’s announcement. “We will prevent the underlying connection from being established by closing the HTTP interface entirely. Only secure HTTPS connections will be allowed.”

## Why This Matters

The Cloudflare API is widely used by developers and system administrators to automate and manage various services including DNS records, firewall configuration, DDoS protection, caching, SSL settings, and security policies. Previously, the system allowed API access over both HTTP and HTTPS, either redirecting or rejecting HTTP requests.

However, even rejected HTTP requests could potentially leak sensitive data like API keys or tokens before the server response. This vulnerability is particularly dangerous on public or shared Wi-Fi networks where adversary-in-the-middle attacks are more feasible.

By disabling HTTP ports entirely for API access, Cloudflare now blocks plaintext connections at the transport layer before any data exchange occurs, enforcing HTTPS from the initial connection.

## Impact on Users

This change immediately affects anyone using HTTP for Cloudflare API services. Scripts, bots, tools, legacy systems, IoT devices, and improperly configured clients that don’t support or default to HTTPS will cease functioning.

For website customers, Cloudflare plans to release a free option later this year that will safely disable HTTP traffic. According to company data, approximately 2.4% of internet traffic passing through their systems still uses the insecure HTTP protocol, rising to nearly 17% when automated traffic is included.

Customers can assess potential impact by monitoring HTTP versus HTTPS traffic on their dashboard under “Analytics & Logs > Traffic Served Over SSL” before implementing the change.