How does the "Server TLS version" check work?

TLS (Transport Layer Security) is the protocol that encrypts communications between the browser and server. There are several versions: TLS 1.0 (1999, vulnerable), TLS 1.1 (2006, obsolete), TLS 1.2 (2008, acceptable) and TLS 1.3 (2018, recommended). This check reports which version the server negotiates.

Why does the "Server TLS version" check matter?

TLS 1.0 and 1.1 contain known vulnerabilities (POODLE, BEAST) and were officially deprecated by the IETF in 2021. Modern browsers reject them. TLS 1.3 is faster (1 round trip instead of 2) as well as more secure.

Security Check n°23 / 120

Server TLS version

TLS (Transport Layer Security) is the protocol that encrypts communications between the browser and server. There are several versions: TLS …

Analyse my site for free

← All checks

What is it?

Understanding "Server TLS version"

The TLS (Transport Layer Security) protocol encrypts exchanges between a browser and a web server. Several successive versions exist — TLS 1.0 and 1.1 (obsolete, removed from standards since 2021), TLS 1.2 (widely used and still secure) and TLS 1.3 (the current version, faster and more secure, published in 2018).

Unlike HTTPS, which is an all-or-nothing question (enabled or not), the negotiated TLS version depends on what the server accepts. A misconfigured server can still accept TLS 1.0/1.1 for historical compatibility, exposing connections using those versions to vulnerabilities documented for years.

❌ TLS 1.0 / 1.1 accepted

🌐 Old browser

→ negotiates TLS 1.0 →

🔓 Vulnerable encryption (BEAST, POODLE)

✅ TLS 1.2 minimum

🌐 Browser

→ negotiates TLS 1.3 →

🔒 Modern encryption

How we check it

How TheSiteFuse checks "Server TLS version"

TheSiteFuse establishes a direct TLS connection to port 443 of the domain using a default SSL context (ssl.create_default_context()), then reads the negotiated version via socket.version(). TLS 1.3 is rated "ok" (best version), TLS 1.2 is rated "ok" with a recommendation to move to TLS 1.3, and any earlier version (1.0, 1.1) triggers an error. If the connection fails (non-HTTPS site, closed port), the result is "not tested" (na).

Risks if it fails

Why "Server TLS version" matters

BEAST and POODLE — TLS 1.0 is vulnerable to the BEAST attack (partial decryption via CBC block manipulation), and its predecessor SSL 3.0 (sometimes still accepted by the same misconfigured servers) to the POODLE attack.
Payment standard non-compliance — the PCI-DSS standard (card payment processing) has explicitly banned TLS 1.0 and 1.1 since 2018; their presence can block certification or a partnership with a payment provider.
Progressive browser removal — Chrome, Firefox and Safari have disabled TLS 1.0/1.1 by default since 2020; a server offering only these old versions simply becomes unreachable to up-to-date browsers.

How to fix

Fix "Server TLS version" step by step

Apache

# mods-available/ssl.conf or SSL vhost
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite HIGH:!aNULL:!MD5

Nginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;

Verification after the change

openssl s_client -connect yoursite.com:443 -tls1
# Should fail if TLS 1.0 is properly disabled

openssl s_client -connect yoursite.com:443 -tls1_3
# Should succeed

After any TLS configuration change, always test with an external tool such as SSL Labs (ssllabs.com/ssltest), which gives an overall grade and details the accepted versions/ciphers.

Learn more

Reference resource

To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.

Wikipedia — Server TLS version

Does your site pass this check?

Run the free full audit (120 checks) and instantly discover what needs fixing.

Previous Cookie security flags Next Subresource Integrity (SRI)