Does your site still accept TLS 1.0 or 1.1?
Whether your server still agrees to connect using TLS 1.0 or TLS 1.1, the old versions of the protocol behind HTTPS.
Why it matters
TLS 1.0 and 1.1 have known weaknesses and are deprecated by the standards body that maintains TLS. Current browsers no longer use them, so leaving them on mainly helps an attacker try to force a weaker connection. Payment and compliance checks often fail a site that still accepts them.
How a survey checks it
Passive check: part of every free survey.
We try one short handshake with each old version and note whether your server agrees. No page is requested over those connections. When we cannot test, we say so instead of reporting a pass.
How to fix it
- Set the minimum TLS version to 1.2 at your host, load balancer or CDN. On Cloudflare this is a single setting.
- If you run your own web server, limit the allowed protocols to TLS 1.2 and TLS 1.3.
Prefer us to do it? Ask for a fix quote
Common questions
Will switching off TLS 1.0 and 1.1 lock anyone out?
Only very old systems, such as browsers and phones that have not had updates for many years. Every current browser uses TLS 1.2 or 1.3.
Do I need TLS 1.3?
It is the fastest and most secure version and most hosts offer it already. Allowing 1.2 and 1.3 together is the usual recommendation.