Post-Quantum Encryption and Your Website: A Practical Check
Where does post-quantum encryption touch your website? A calm, practical TLS 1.3 check for a business site, without the alarm or the jargon.
rabbitclip teamPublished: 6 min read
Short answer
Post-quantum encryption is the name for new methods built in case quantum computers one day break today's encryption. For a business site the practical meaning is not a large project but a check: is TLS 1.3 switched on, because if it is and the visitor's browser supports it, the post-quantum key exchange will often switch itself on without you doing anything extra. For a site behind Cloudflare, that is exactly how it works.
According to Cloudflare's post of 29 September 2026, the browser side has already spread widely; what remains is on the server side. So the question is not whether to set aside a budget to prepare for the future, but whether your current setup stands in the way of this support.
Below you will find where post-quantum encryption touches your site, the figures Cloudflare published, how to check, the mistakes made most often, and the situations in which you need not spend time on this at all.
Where does post-quantum encryption touch a website?
When a visitor connects to your site over https, the browser and the server first agree on a shared secret key; this is called key exchange. Post-quantum encryption targets that step. The method in Cloudflare's post is a hybrid: today's X25519 method works together with the new ML-KEM method (X25519MLKEM768). If one proves unexpectedly weak, the other still stands.
This does not change your content, your pages or your database. What changes is how the handshake between browser and server is made. That makes it less a web design or software job and more a question of infrastructure settings.
What do Cloudflare's figures show?
Cloudflare's post of 29 September 2026, drawing on Cloudflare Radar data, says that roughly 70 percent of browser traffic uses hybrid ML-KEM key exchange. For the origin servers Cloudflare connects to, the machines where the site is actually hosted, the share is roughly 15 percent.
That gap tells us something practical: the visitor side is largely ready and the server side is not yet. The figures belong to Cloudflare's own traffic; they do not reflect Turkey or your own site. They still show where the missing link lies.
- Roughly 70 percent of browser traffic uses hybrid ML-KEM
- Only roughly 15 percent of origin servers do
- The figures describe Cloudflare's own network, not every site
How do you run a practical check on your site?
If you use Cloudflare, the first place to look is the Edge Certificates setting under SSL/TLS; TLS 1.3 should be on. According to Cloudflare's post, if the visitor's browser supports it, Cloudflare chooses the post-quantum key exchange itself, and there is no separate setting for it.
There are two ways to see what actually happens. The Security tab in Chrome DevTools shows the key exchange algorithm of a connection. On the Cloudflare side, a new TLS Key Exchange Groups card has appeared in HTTP Traffic Analytics, along with ClientTLSKeyExchangeGroup and OriginTLSKeyExchangeGroup fields in Logpush and Log Explorer. If you do not use Cloudflare, you can look over your site's general security state with rabbitclip's security check.
- Is TLS 1.3 on under SSL/TLS, Edge Certificates
- Does the Chrome DevTools Security tab show the key exchange
- The TLS Key Exchange Groups card in HTTP Traffic Analytics
- The ClientTLSKeyExchangeGroup and OriginTLSKeyExchangeGroup fields in Logpush and Log Explorer
- Asking your hosting company whether the server supports TLS 1.3
What if the origin server does not support it?
Cloudflare's recommendation, if your origin server does not support this key exchange, is to use Cloudflare Tunnel. The tunnel sets up the connection between Cloudflare and your server. For the detailed setup you need Cloudflare's documentation; here we only relay the recommendation named in the post.
There is movement on certificates too. On 29 September 2026 Cloudflare set out a plan for a post-quantum certificate authority built on Merkle Tree Certificates and wrote that it would issue free certificates. On 1 October 2026 it announced native Web Crypto support for ML-KEM and ML-DSA in Workers, as an opt-in. These are a plan and a developer feature; do not treat them as work to do on a business site today.
What mistakes are common here?
The most common mistake is either to ignore the subject entirely or to panic and buy expensive consultancy. Neither is needed. The third is not remembering a setting that switched TLS 1.3 off years ago, perhaps under an old security instruction.
Another is confusing post-quantum encryption with certificate renewal. Your certificate's expiry is a separate matter, and post-quantum encryption does not change it today.
- Ignoring it or panicking over it
- Buying expensive consultancy
- Not noticing a TLS 1.3 setting switched off years ago
- Confusing certificate renewal with key exchange
When is this work unnecessary or the wrong choice?
If your site is not behind Cloudflare or a similar network and its control panel lives only with your hosting company, the first step is to ask the company; do not go into server settings on your own. For a brochure site with very few visitors that holds no sensitive data, spending hours on this would also be a wrong priority.
Cloudflare writes that it is targeting 2029 for full post-quantum security and refers to a NIST proposal to retire RSA and ECC by 2030. These dates are Cloudflare's account and a proposal, not a settled timetable. A calm check is enough for today.
In short: make sure TLS 1.3 is on, ask your hosting company about your origin server, and do not panic about the rest. The visitor side is largely ready; the missing link is mostly on the server side. If you would like to go through your infrastructure settings together, we are glad to have a calm discovery conversation with you at rabbitclip.
FAQ
Do I need to install anything on my site for post-quantum encryption?
Behind Cloudflare, generally not. According to Cloudflare's post, if TLS 1.3 is on and the visitor's browser supports it, Cloudflare chooses the post-quantum key exchange itself. There is no separate setting.
How do I find out whether TLS 1.3 is on?
In Cloudflare, look under Edge Certificates in the SSL/TLS section. If you do not use Cloudflare, ask your hosting company. The Security tab in Chrome DevTools also shows the details of a connection.
What is ML-KEM?
It is a key exchange method for the post-quantum era. In the hybrid form Cloudflare describes, it works together with today's X25519 method, and the combination is written X25519MLKEM768.
Is this an emergency?
Cloudflare's post does not describe an emergency; it describes visibility and preparation. The reasonable step for a business site is to check TLS 1.3 and find out the state of the origin server.
Sources
The specific facts in this article rest on these official pages; check them for the current position.
