Skip to content

Basics

How to disable TLS 1.0 and 1.1

TLS 1.0 and 1.1 are deprecated and rejected by current browsers, and they fail PCI compliance if you take payments. Modern hosts default to 1.2 and 1.3, so seeing anything older usually means an old load balancer or proxy in front of the app.

What 13x checks

This is rule basics.tls-version in the public registry: Modern TLS version. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Basics
Score weight
4 of the readiness score
Scope
Runs on every audited page
Applies
Only where the market or the page shape makes it relevant

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

The connection negotiated ``. Restrict it to TLS 1.2 and 1.3:

nginx code
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

TLS 1.0 and 1.1 are rejected by current browsers and fail PCI DSS if you take card payments. Modern managed hosts do not offer them, so seeing an old version usually means an old load balancer, proxy or WAF in front of the application — check there rather than in the app config.

Verify at ssllabs.com/ssltest, which also reports weak ciphers this check does not look at.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More basics checks