Docs

Turn off TLS 1.0 and 1.1

Turn off TLS 1.0 and 1.1

TLS is the encryption under every https:// connection. Versions 1.0 (1999) and 1.1 (2006) have known weaknesses and were formally retired in 2021 (RFC 8996). Every current browser has stopped using them, and PCI DSS, the standard card payments follow, has not allowed them for years. A server that still accepts them gains no visitors; it only fails security scans, payment-provider and customer audits, and leaves a weaker door open.

Turning them off is a configuration change on the server, not in the website. The site checklist tries to connect with TLS 1.0 and 1.1 and warns when the server agrees.

What the checklist expects

What the server does Result
accepts TLS 1.2 and 1.3, refuses 1.0 and 1.1 OK
still accepts TLS 1.0 or 1.1 warning
offers nothing newer than TLS 1.1 fail: current browsers cannot open the site at all

Who loses access when you turn them off: Internet Explorer on Windows 7 and earlier without updates, Android 4.3 and older, and very old scripts or devices that call your site. In practice, nobody who visits a website in a browser today.

Check it yourself

Replace example.com with your site:

openssl s_client -connect example.com:443 -servername example.com -tls1   -cipher 'DEFAULT@SECLEVEL=0' </dev/null 2>&1 | grep -E 'Protocol|alert|Cipher is'
openssl s_client -connect example.com:443 -servername example.com -tls1_1 -cipher 'DEFAULT@SECLEVEL=0' </dev/null 2>&1 | grep -E 'Protocol|alert|Cipher is'
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null 2>&1 | grep -E 'Protocol|Cipher is'

Fixed: the first two end with an error such as alert protocol version or Cipher is (NONE), and the third shows Protocol: TLSv1.2 (or TLSv1.2 next to Cipher is). If the first or second shows Protocol: TLSv1 or TLSv1.1 with a cipher, the old version is still on.

-cipher 'DEFAULT@SECLEVEL=0' matters: OpenSSL 3 refuses the old versions on its own side, which would look like a pass. If your openssl answers no protocols available or unknown option, it cannot test old versions at all; use nmap --script ssl-enum-ciphers -p 443 example.com instead, which lists every version the server accepts.

How to fix

This is a server setting: WordPress or any other CMS cannot change it. On shared hosting, ask your host to accept only TLS 1.2 and 1.3; most do so already, and the rest change it for the whole server. Otherwise pick what you have access to.

cPanel

On shared cPanel hosting this belongs to the host: ask support to limit the web server to TLS 1.2 and 1.3.

With WHM (your own server or VPS):

  1. Open Service Configuration → Apache Configuration → Global Configuration.
  2. In SSL/TLS Protocols, enter -all +TLSv1.2 +TLSv1.3 (the field takes Apache's SSLProtocol syntax). It must not list TLSv1 or TLSv1.1.
  3. Save and Rebuild Configuration and Restart Apache.

If the server runs LiteSpeed Web Server instead of Apache, check its own SSL settings as well and restart it.

Plesk

On Linux, as the administrator:

  1. Open Tools & Settings → SSL/TLS Ciphers (in some versions under Security).
  2. Leave only TLSv1.2 and TLSv1.3 ticked and apply.

The same from the command line:

plesk bin server_pref -u -ssl-protocols 'TLSv1.2 TLSv1.3'

On Plesk for Windows, protocols are set in Windows itself: see the IIS tab.

DirectAdmin

As root, set CustomBuild's TLS profile to Mozilla's intermediate (TLS 1.2 and 1.3) and rewrite the web server configuration:

cd /usr/local/directadmin/custombuild
./build set ssl_configuration intermediate
./build rewrite_confs

nginx

Set the protocols in the http { … } block of /etc/nginx/nginx.conf (the same path on Debian, Ubuntu, Rocky, Alma and CentOS):

http {
    ssl_protocols TLSv1.2 TLSv1.3;
}

Then look for other lines that override it:

grep -rn ssl_protocols /etc/nginx/ /etc/letsencrypt/options-ssl-nginx.conf 2>/dev/null

Every ssl_protocols line must say the same. nginx picks the protocol before it knows which site is being asked for, so the default server on port 443 decides for every site on that IP: one old line there keeps TLS 1.0 on for all.

sudo nginx -t && sudo systemctl reload nginx

Apache and LiteSpeed

With server access (Apache). On Debian and Ubuntu, edit /etc/apache2/mods-available/ssl.conf; on Rocky, Alma and CentOS, /etc/httpd/conf.d/ssl.conf:

SSLProtocol -all +TLSv1.2 +TLSv1.3

Check that no virtual host or included file sets it differently (Certbot's /etc/letsencrypt/options-ssl-apache.conf does set it):

grep -rn SSLProtocol /etc/apache2/ /etc/httpd/ /etc/letsencrypt/ 2>/dev/null
sudo apachectl configtest && sudo systemctl reload apache2

(httpd instead of apache2 on Rocky, Alma and CentOS.) On those systems from version 8 on, the system-wide crypto policy already excludes TLS 1.0 and 1.1; if they are still accepted, an explicit SSLProtocol line is overriding it.

Without server access (shared hosting, LiteSpeed). TLS cannot be set in .htaccess. Ask your host.

Cloudflare

When the site is proxied through Cloudflare (orange cloud), visitors and the checklist connect to Cloudflare, not to your server.

  1. Open the domain and go to SSL/TLS → Edge Certificates.
  2. Set Minimum TLS Version to TLS 1.2.

Your own server can still accept the old versions for connections that bypass Cloudflare; fix it there too, using the tab for your server.

IIS and ASP.NET

Windows sets TLS versions for the whole server (SCHANNEL), not per site. The easiest way is the free IIS Crypto tool from Nartac: apply the Best Practices template, make sure TLS 1.0 and 1.1 are unticked under Server Protocols, and restart.

Or set the registry keys yourself in an administrator PowerShell, then restart the server:

foreach ($version in 'TLS 1.0', 'TLS 1.1') {
    $key = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$version\Server"
    New-Item -Path $key -Force | Out-Null
    New-ItemProperty -Path $key -Name Enabled -Value 0 -PropertyType DWord -Force | Out-Null
    New-ItemProperty -Path $key -Name DisabledByDefault -Value 1 -PropertyType DWord -Force | Out-Null
}

Warning: These keys only affect connections to this server. Before restarting, make sure nothing else on it (an old SQL Server, Remote Desktop on an unpatched system, an old .NET application) depends on TLS 1.0 for incoming connections.

Hosted platforms

Shopify, Wix, Squarespace and Webflow run the servers themselves and already refuse TLS 1.0 and 1.1. If the checklist says otherwise there, the domain is most likely pointing at something else (an old server or a proxy).

Confirm the fix

Run the openssl commands from Check it yourself again, then open the target in PulseKeeper and click Check now on the Checklist tab.