TLS (Transport Layer Security) is the protocol that encrypts traffic between your visitors and your web server. But not all versions are equally secure. TLS 1.0 and 1.1 are now considered insecure and deprecated. If your server still supports them, you're offering visitors a connection that can be attacked.
Why they're no longer safe
Both protocols have known cryptographic weaknesses:
- POODLE (CVE-2014-3566) — downgrades a TLS connection to steal session cookies
- BEAST (CVE-2011-3389) — recovers plaintext from TLS 1.0 connections
- Weak cipher suites — older TLS versions support ciphers that have since been broken
Who deprecated them
- The IETF deprecated both in RFC 8996 (March 2021)
- All major browsers (Chrome, Firefox, Safari, Edge) disabled support in 2020
- PCI DSS has required TLS 1.2+ since 2018
If your site handles payment data and still accepts TLS 1.0/1.1, you are likely out of PCI DSS compliance.
What you should be running
TLS 1.2 is the minimum acceptable standard. TLS 1.3 is the current best — faster and more secure by design, having removed all problematic cipher suites. Your server should support only TLS 1.2 and 1.3.
threatprobe.app's free scan checks which TLS protocol versions your server accepts and flags anything below 1.2. The Basic report adds a full cipher suite audit and Heartbleed check.