Which TLS version does
your site actually speak?

Type the hostname above. We don't just report the version your browser happens to pick — we send five separate ClientHellos, one per protocol from SSL 3.0 to TLS 1.3, so you see everything the server accepts, not just the best it speaks. In a browser you can see the negotiated version only: DevTools, Security tab. Free, no sign-up, and every result has a permanent share link and an SVG status badge.

Same thing, two names. SSL was Netscape's protocol; it was renamed TLS when it became an internet standard in 1999 — TLS 1.0 is literally SSL 3.1. The actual SSL protocols (2.0 and 3.0) have been dead for a decade, but the name survived in phrases like "SSL certificate". When anyone says "check the SSL version" today, they mean the TLS version — and certificates are protocol-neutral either way.

Because you're not the one who'll use it. Every protocol your server accepts is attack surface — downgrade tricks work by steering a connection onto the weakest thing enabled, not the best. It's also paperwork: TLS 1.0/1.1 enabled is an automatic finding on a PCI DSS scan (banned on payment pages since 2018) and both were formally deprecated by RFC 8996 in 2021. And it signals config age — a server still answering TLS 1.0 carries the cipher list of the same era.

Almost never. The clients that genuinely top out at TLS 1.0 are museum pieces: Android 4.3 and older (2013), IE 10, Java 7, and some embedded devices. Mainstream browsers dropped 1.0/1.1 support entirely in 2020 — a visitor who needs it can't browse most of the web anyway. The professional move: grep a week of access logs for those user-agents before flipping the switch. The usual answer is a fraction of a percent, and mostly bots.

Yes, and it's nearly free. The handshake completes in one round trip instead of two — a real speed win on every first connection, biggest on mobile latency. Repeat visitors can resume with zero round trips. And it removes whole vulnerability classes by design: no CBC padding oracles, no static-RSA key exchange, no renegotiation. If your server's OpenSSL is 1.1.1 or newer (2018 — every current distro), enabling it is one word in the config.

Use the port selector — mail servers (465 smtps, 993 imaps), admin panels on 8443, APIs on custom ports all negotiate TLS the same way. For SMTP on port 25 the connection starts in plaintext and upgrades, so the probe speaks STARTTLS first — the openssl equivalent is -starttls smtp. Mail servers are where TLS 1.0 survives longest, because nobody's browser ever complains about them.

Yes, and the free watcher on this page is the part that does it. Run a check, leave your address, and we re-read that one host daily and email you if the configuration regresses — a legacy protocol reopens, a weak cipher returns, TLS 1.3 disappears, or the best protocol drops. No account needed. Uptimia's paid SSL monitoring covers the other half, the certificate: it records the negotiated protocol on every check and alerts on expiry, chain and hostname problems. Config drifts when infrastructure changes; a scheduled re-read is how you find out before an auditor or an outage does.