TLS versions: disable TLS 1.0 and 1.1

TLS is the protocol behind HTTPS. There are several versions, and your web server decides which ones it accepts. The old versions TLS 1.0 and 1.1 are considered insecure; a modern server only offers TLS 1.2 and TLS 1.3.

Check your website now

Which versions exist

When setting up an HTTPS connection, the browser and server agree on which TLS version to use. If your server still supports old versions, a connection can in some situations end up on a weaker version than necessary.

TLS 1.0 (1999) and TLS 1.1 (2006): outdated. They were officially deprecated in 2021 (RFC 8996), and modern browsers no longer support them.
TLS 1.2 (2008): still secure and widely supported.
TLS 1.3 (2018): the latest version. Faster at setting up the connection and free of the weak parts of earlier versions.
SSL 2.0 and SSL 3.0, the predecessors of TLS, should have been switched off long ago.

Why TLS 1.0 and 1.1 should be off

TLS 1.0 and 1.1 use outdated cryptography and are vulnerable to known attacks. Browsers no longer use them, so leaving them on gains you practically nothing. Only very old devices and programs still need them, such as Android 4.3 and older, or old versions of Internet Explorer on Windows 7 without updates.

For almost every website, it's acceptable that those devices can no longer connect. If you're unsure, for example because old point-of-sale systems or scanners talk to your server, check that first.

Turning off old versions

With many hosting providers, server panels and CDNs, you set the minimum TLS version through a setting; in Cloudflare, for example, it's called Minimum TLS Version. Choose TLS 1.2 there. If you manage the server yourself, you configure it in the web server.

nginx

ssl_protocols TLSv1.2 TLSv1.3;

Turning off old versions in Apache

If you use Apache, put this in your virtual host configuration or in the global SSL configuration. Then restart the web server.

Apache

SSLProtocol -all +TLSv1.2 +TLSv1.3

Test the TLS versions yourself

With OpenSSL you can test, version by version, whether the server accepts a connection. If the connection succeeds with -tls1 or -tls1_1, that old version is still on. Newer versions of OpenSSL sometimes refuse TLS 1.0 and 1.1 themselves; in that case, add -cipher 'DEFAULT:@SECLEVEL=0' to test it anyway.

Terminal

openssl s_client -connect example.com:443 -servername example.com -tls1_1 </dev/null
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null
openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null

How SteadyHost rates TLS versions

OK: the server only accepts TLS 1.2 and/or TLS 1.3.
Warning: TLS 1.0 or TLS 1.1 is still on.
Problem: neither TLS 1.2 nor 1.3 works, or the server doesn't offer HTTPS on port 443.
This check doesn't count toward the score.

Check your own website

A free check shows within seconds how your website is doing: availability, HTTPS and TLS, the SSL certificate, security headers, DNS and DNSSEC, domain registration and email security.