Last updated October 5, 2026 · Report an error
TLS 1.0 and 1.1 are deprecated and considered insecure by modern standards; TLS 1.2 and 1.3 are the current baseline. This tool forces a live connection at each TLS version in turn and reports which ones a server actually accepts.
How it works
For each TLS version, a connection is forced using both a minimum and matching maximum version flag — this is important because setting just a minimum alone lets the connection silently succeed by negotiating a newer version instead, which would misreport an old-version test as passing.
- Enter website URL.
- Click Calculate to see your results.
Examples
A modern, properly hardened server
A server that has disabled legacy protocols will accept connections forced to TLS 1.2 and 1.3, but reject exact-forced TLS 1.0 and 1.1 attempts outright.
Who should use it
- Auditing a server's TLS configuration after a hardening or migration change.
- Verifying legacy TLS versions have actually been disabled as intended.
Industry applications
- IT security and compliance audits
- Web hosting/DevOps configuration verification
Advantages
- Forces an exact TLS version per test (min + max flags together), rather than reporting whatever version was negotiated by default.
- Transparently documents the one real limitation (legacy-protocol restrictions on the checking side) rather than overclaiming precision.
Limitations
- Cannot fully distinguish server-side rejection of legacy TLS from a client-side (checking environment) restriction.
Common mistakes to avoid
- Testing only the minimum version flag and assuming a successful connection proves that exact old version is supported — it may have silently negotiated a newer one instead.
- Concluding a server is fully insecure from a single TLS 1.0/1.1 "not supported" result without accounting for the checking environment's own client-side restrictions.
Best practices
- Treat a TLS 1.2/1.3-only result as the modern, secure baseline — that's the intended, recommended configuration for a properly hardened server.
- If auditing for legitimate PCI-DSS or compliance purposes, cross-check the TLS 1.0/1.1 result with a dedicated SSL/TLS scanning service to rule out client-side false negatives.
Tips
- Pair with the HSTS Checker — both address different parts of a site's overall HTTPS security posture.