Cloudflare's "Flexible" SSL trap, and the real DNS wait time for a hosting migration

Two mistakes come up constantly when small businesses move hosts or put Cloudflare in front of a WordPress site. Both are documented, both are avoidable, and neither gets explained clearly enough in the usual how-to posts.

The Cloudflare redirect loop nobody expects

If your web server already redirects HTTP to HTTPS (most do, by default, on any half-decent host), and you set Cloudflare's SSL/TLS mode to "Flexible", you get an infinite redirect loop. Cloudflare's own docs say it plainly:

"If your origin forces HTTPS by automatically redirecting HTTP requests to HTTPS, do not use Flexible mode. Because Cloudflare connects to your origin over HTTP, this creates a redirect loop that makes your site inaccessible."

Source: developers.cloudflare.com/ssl/origin-configuration/ssl-modes/flexible

The fix is one dropdown: switch to Full or Full (strict) mode so Cloudflare validates against your origin's real certificate instead of connecting over plain HTTP. It's the single most common reason a DIY Cloudflare setup takes a working site down within minutes of flipping the nameservers — ERR_TOO_MANY_REDIRECTS in the browser, no obvious cause in the Cloudflare dashboard.

How fast does a DNS change actually happen?

Worth knowing precisely, since "up to 48 hours" gets thrown around vaguely everywhere: Cloudflare's proxied (orange-cloud) DNS records carry a fixed TTL of 300 seconds that you cannot lower. Plain DNS-only (grey-cloud) records can go as low as 60 seconds on any paid plan, 30 seconds on Enterprise.

The catch: a low TTL only controls how long compliant resolvers cache a record. Some ISP-level resolvers ignore the TTL you set and hold onto the old address for up to 24-48 hours regardless. That's why a careful migration or Cloudflare cutover is planned around that worst case — test on a temporary address first, switch DNS last — rather than promising an instant cutover.

If the domain name itself is changing too (not just the host), that's a different problem entirely: Google's Change of Address tool in Search Console needs 301 redirects held live for at least 180 days before Google stops crediting the old domain. After that window, Google treats the old site as unrelated.

Disclosure: I work with ZoopCoder, where we run this exact process for clients — Cloudflare setup for a fixed ₹1,499, and website migration to new hosting for a fixed ₹1,999, usually 1-2 working days. Sharing the underlying facts here in case they save someone else a redirect-loop debugging session.