---
title: Opportunistic Encryption · Cloudflare SSL/TLS docs
description: Opportunistic Encryption allows browsers to access HTTP URIs over
  an encrypted TLS channel. It's not a substitute for HTTPS, but provides
  additional security for otherwise vulnerable requests.
lastUpdated: 2024-12-16T22:33:26.000Z
chatbotDeprioritize: false
source_url:
  html: https://developers.cloudflare.com/ssl/edge-certificates/additional-options/opportunistic-encryption/
  md: https://developers.cloudflare.com/ssl/edge-certificates/additional-options/opportunistic-encryption/index.md
---

Opportunistic Encryption allows browsers to access HTTP URIs over an encrypted TLS channel. It's not a substitute for HTTPS, but provides additional security for otherwise vulnerable requests.

Use HTTPS when both strong encryption and authentication are required. HTTP Opportunistic Encryption provides a means of enabling TLS when needed for other protocols such as HTTP/2. It does not provide the same indications of security as HTTPS (the green lock icon in most browser address bars).

## Availability

| | Free | Pro | Business | Enterprise |
| - | - | - | - | - |
| Availability | Yes | Yes | Yes | Yes |

## Enable Opportunistic Encryption

You do not need to configure your origin web server to support Opportunistic Encryption. All it requires is updating your settings in the Cloudflare dashboard.

* Dashboard

  To enable Opportunistic Encryption in the dashboard:

  1. Log in to your [Cloudflare account](https://dash.cloudflare.com) and go to a specific domain.
  2. Go to **SSL/TLS** > **Edge Certificates**.
  3. For **Opportunistic Encryption**, switch the toggle to **On**.

* API

  To adjust your Opportunistic Encryption settings with the API, send a [`PATCH`](https://developers.cloudflare.com/api/resources/zones/subresources/settings/methods/edit/) request with `opportunistic_encryption` as the setting name in the URI path, and specify the `value` parameter with your desired setting (`"on"` or `"off"`).

Note

To use this feature on specific hostnames - instead of across your entire zone - use a [configuration rule](https://developers.cloudflare.com/rules/configuration-rules/).
