Disable the RC4 cipher on Cloudflare

Why it matters

RC4 is a broken cipher that attackers can use to recover encrypted data, and it has been banned from TLS since 2015. No current browser needs it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Cloudflare never offers RC4, so this host is DNS only (grey cloud) or not on Cloudflare at all. The finding is about the server that answers, so fix the origin with the nginx, Apache or generic steps.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cipher suites check
• Disable the 3DES cipher
• Offer modern AEAD ciphers
• Require forward-secret ciphers
• Retire the old TLS versions that use CBC ciphers