It's worth noting that "Flexible SSL" is the lowest security option available - Cloudflare provide access to a free private CA (https://blog.cloudflare.com/clou

It's worth noting that "Flexible SSL" is the lowest security option available - Cloudflare provide access to a free private CA (https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/) in order to encourage people to secure their backend connections. I wonder if they might help combat the illusion of security by providing a response header, well-known image URL or similar to indicate the backend SSL status.