Cloudflare now blocks all unencrypted traffic to its API endpoints

Cloudflare has fully disabled HTTP access to api.cloudflare.com, enforcing HTTPS-only connections to eliminate the risk of sensitive data exposure from plaintext requests, particularly over public networks. This change affects scripts, bots, legacy systems, and low-level clients that rely on HTTP, and Cloudflare recommends customers review their traffic analytics to assess impact ahead of an upcoming option to safely disable HTTP for their own sites.