Post-quantum cryptography (PQC) is the defense: a new generation of encryption algorithms built on mathematical problems that even quantum computers are not expected to solve. The U.S. National Institute of Standards and Technology (NIST) finalized its first three post-quantum standards in August 2024, including ML-KEM (FIPS 203)<\/strong> \u2014 the algorithm at the center of Cloudflare’s latest update.<\/p>\n\n\n\n On April 30, Cloudflare announced that post-quantum encryption for its IPsec tunnels is now generally available<\/strong>. IPsec is the protocol that secures site-to-site network connections \u2014 the encrypted tunnels between data centers, branch offices, and cloud environments that sit beneath the services your website depends on.<\/p>\n\n\n\n Cloudflare’s implementation uses hybrid ML-KEM<\/strong>: it runs a classical Diffie-Hellman key exchange first, then layers ML-KEM on top. The result is a handshake that’s protected by both classical and post-quantum encryption simultaneously. Even if quantum computers eventually break one layer, the other still holds.<\/p>\n\n\n\n The big headline: Cloudflare has confirmed interoperability with Cisco and Fortinet<\/strong> \u2014 two of the most widely deployed network hardware vendors in the world. This means the upgrade doesn’t require replacing existing infrastructure. Organizations using Cisco SD-WAN routers or Fortinet branch connectors can enable post-quantum protection on connections they already have.<\/p>\n\n\n\n This follows Cloudflare’s announcement earlier this month that it is accelerating its full post-quantum security target to 2029<\/strong> \u2014 moved forward from previous estimates, driven by faster-than-expected progress in quantum computing research.<\/p>\n\n\n\n You might be thinking: “I just host a website. I’m not running site-to-site VPNs or branch offices.” Fair enough. But here’s the broader picture.<\/p>\n\n\n\n Your hosting provider’s infrastructure is a target.<\/strong> Hosting companies manage thousands of customer sites, databases, email accounts, and control panels. The network connections between their data centers, CDN nodes, and upstream providers are exactly the kind of high-value traffic that adversaries are harvesting today.<\/p>\n\n\n\n Cloudflare is deeply integrated with modern hosting.<\/strong> If your site runs behind Cloudflare \u2014 for CDN, DDoS protection, or DNS<\/a> \u2014 you’re already benefiting from Cloudflare’s post-quantum TLS. According to Cloudflare’s own data, more than two-thirds of human-generated TLS traffic to their network is already protected by post-quantum cryptography. The IPsec update now extends that protection to the network layer beneath.<\/p>\n\n\n\n The PHP and SSL parallels are instructive.<\/strong> When the industry moved from HTTP to HTTPS<\/a>, hosting providers that were slow to adopt SSL lost customer trust. When PHP 5 reached end-of-life, sites running old versions became vulnerable targets. Post-quantum is the next transition \u2014 and the hosting providers that prepare early will be better positioned when Q-Day arrives.<\/p>\n\n\n\n Data with long shelf life is already at risk.<\/strong> If your site collects customer data \u2014 emails, orders, account information \u2014 that data has a long “secrecy window.” It needs to remain private not just today, but for years. Traffic your users sent three years ago could be sitting in an adversary’s archive right now, waiting for the day it can be decrypted.<\/p>\n\n\n\n The honest answer: for most shared hosting customers, the immediate action is awareness, not panic. You don’t need to rebuild your infrastructure today.<\/p>\n\n\n\n But here’s a practical checklist for assessing your exposure:<\/p>\n\n\n\n 1. Check if your hosting provider uses Cloudflare infrastructure<\/strong> If your CDN, DNS, or DDoS protection runs through Cloudflare, you’re already benefiting from post-quantum TLS on the edge. That’s a meaningful layer of protection.<\/p>\n\n\n\n 2. Verify your SSL\/TLS configuration is current<\/strong> Make sure your site is running TLS 1.3 \u2014 older versions (TLS 1.0, 1.1) are more vulnerable and deprecated by most browsers. Most modern hosting control panels (including cPanel) let you enforce TLS 1.3 minimum.<\/p>\n\n\n\n 3. Understand what data you’re collecting<\/strong> Sites that collect personal data, payment information, or login credentials have more to lose from harvest-now-decrypt-later attacks than static informational sites. Know your risk profile.<\/p>\n\n\n\n 4. Ask your hosting provider about their post-quantum roadmap<\/strong> This is the key question going into the next two years. Hosting providers that are actively upgrading their infrastructure to post-quantum standards \u2014 including their CDN partnerships and network tunnels \u2014 are better long-term partners.<\/p>\n\n\n\n 5. Keep software updated<\/strong> Outdated WordPress installations, plugins, and PHP versions are immediate, exploitable vulnerabilities today. Don’t let a future threat distract from present-tense security hygiene.<\/p>\n\n\n\n Until recently, most estimates placed the arrival of cryptographically relevant quantum computers (CRQCs) \u2014 machines powerful enough to break current public-key cryptography \u2014 somewhere between 2030 and 2040.<\/p>\n\n\n\n That timeline has compressed. In March 2026, researchers from Google Quantum AI, the Ethereum Foundation, and Stanford published a paper showing that breaking elliptic curve cryptography (the backbone of today’s web security) could require fewer physical qubits than previously estimated \u2014 roughly 20 times fewer than earlier benchmarks suggested.<\/p>\n\n\n\n Cloudflare explicitly cited this research when it moved its post-quantum deadline forward to 2029.<\/p>\n\n\n\n No one knows exactly when Q-Day arrives. But the harvest-now-decrypt-later threat doesn’t require Q-Day to have already happened. It’s happening right now, in the background \u2014 encrypted traffic being collected, archived, and held in anticipation of future decryption capability.<\/p>\n\n\n\n At Copahost, we take infrastructure security seriously. Our web hosting servers<\/a> run behind Cloudflare, meaning our customers’ sites already benefit from post-quantum TLS at the network edge. We’re actively monitoring the development of ML-KEM standards and their integration across our infrastructure stack.<\/p>\n\n\n\n As the post-quantum transition accelerates, we’ll continue updating our infrastructure \u2014 and keeping you informed about what it means for your site.<\/p>\n\n\n\n Post-quantum cryptography isn’t a feature you toggle on one day. It’s an ongoing migration, and the time to start thinking about it is now.<\/p>\n\n\n\n Cloudflare Blog: Post-quantum encryption for Cloudflare IPsec is generally available<\/a> \u2014 April 30, 2026 Cloudflare: Post-quantum roadmap, 2029 target<\/a>NIST FIPS 203 \u2014 ML-KEM Standard<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":" If you’ve been hearing the term “post-quantum cryptography” lately and dismissing it as something only governments and banks need to worry about, it’s time to take a second look. On April 30, 2026, Cloudflare made a quiet but significant announcement: post-quantum encryption for IPsec is now generally available \u2014 and it works with Cisco and […]<\/p>\n","protected":false},"author":1,"featured_media":4342,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[63],"tags":[],"class_list":["post-4341","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security"],"yoast_head":"\n![\"ML-KEM](\"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/imagem-1-1024x612.png\")
<\/figure>\n\n\n\nWhat Cloudflare just launched<\/h2>\n\n\n\n
![\"How](\"https:\/\/www.copahost.com\/blog\/wp-content\/uploads\/2026\/05\/imagem-1024x627.png\")
<\/figure>\n\n\n\nWhy does this matter for web hosting?<\/h2>\n\n\n\n
What should site owners do right now?<\/h2>\n\n\n\n
The bigger picture: Q-Day is a moving target<\/h2>\n\n\n\n
What Copahost is doing<\/h2>\n\n\n\n
Further reading<\/h2>\n\n\n\n
Help Net Security: Cloudflare moves up its post-quantum deadline<\/a> \u2014 April 7, 2026
The Quantum Insider: Why 2026 Matters for Quantum Security<\/a><\/p>\n\n\n\n