Supply chain· 28 Oct 2025· 3 min read

Most human web traffic to Cloudflare is now post-quantum encrypted

Client-side migration crossed the halfway line in October 2025; the remaining gap is origin servers and enterprise middleboxes.

Cloudflare reported in its State of the post-quantum Internet update, published 28 October 2025, that the majority of human-initiated traffic to its network was using post-quantum encryption, mitigating harvest-now-decrypt-later exposure for that traffic.

The change came from browsers and edge networks enabling hybrid X25519 with ML-KEM by default rather than from individual site owners acting.

In February 2026 Cloudflare Radar added tracking for post-quantum support on origin servers plus a tool to test any host, which shifts the visible gap from browsers to the backend half of the connection.

What it means for your migration

Front-door TLS is largely handled by your CDN and browsers; the uncovered risk is connections behind it — origin, service-to-service and VPN links.
Test your own hostnames rather than assuming CDN coverage means end-to-end coverage.
Middleboxes and inspection appliances remain a common cause of failed post-quantum handshakes.

These figures measure traffic seen by one network. They describe key exchange, not signatures, and say nothing about data already captured.

Chronology

Timeline of events

Every step in this story with its date, authority and evidence class.

13 Aug 2024A1
ML-KEM standardised
FIPS 203 makes the hybrid key exchange deployable as a standard.
NIST ↗
28 Oct 2025B2
Majority of human traffic post-quantum
Cloudflare reports crossing the 50% mark for human-initiated requests.
Cloudflare ↗
27 Feb 2026B2
Radar adds origin post-quantum tracking
New tooling measures post-quantum support on origin servers and lets anyone test a host.
Cloudflare ↗