Security & SEO

    TLS version & cipher check

    Confirms your server supports TLS 1.2/1.3, rejects TLS 1.0/1.1, and uses forward-secret cipher suites.

    Updated 2026-07-10
    1 min read
    tls
    ssl
    ciphers

    Quick answer#

    We negotiate handshakes across TLS 1.0-1.3 and record which versions and ciphers your server accepts.

    What it checks#

  1. TLS 1.3 supported (+bonus)
  2. TLS 1.2 supported (required)
  3. TLS 1.0/1.1 rejected (required for A grade)
  4. Forward-secret ciphers only (ECDHE-based)
  5. No RC4, 3DES, or export ciphers

    6. Where to find it in Lemwatch#

    Site details → Security → SSL.

    How to fix#

  6. In nginx/Apache, set ssl_protocols TLSv1.2 TLSv1.3;.
  7. Use Mozilla SSL Config Generator's "intermediate" profile.
  8. Reload the server.
  9. Re-run the check.

    10. FAQ#

    Will disabling TLS 1.0 break old clients?#

    Maybe IE10 on Windows 7. All modern browsers/apps support 1.2+.

    Should I enable TLS 1.3 only?#

    Too aggressive — some corporate proxies stall on 1.3.

    Related#

  10. SSL monitoring
  11. Why did my SSL grade drop
  12. Certificate chain check
    13. Was this article helpful?

    Previous

    Cookie security check

    Next

    Certificate chain check

    Related Articles

    SSL Certificate Monitoring

    Track SSL certificate validity, expiry dates, and chain issues. Get warned 30, 14, and 7 days before certificates expire.

    Why did my SSL grade drop?

    SSL grade drops when a cipher, protocol, or certificate chain changes — here is how to identify the exact cause and fix it.

    Certificate chain check

    Verifies your TLS cert is served with the full intermediate chain — the #1 cause of "insecure connection" errors on Android and older curl.

    Broken Links Detection

    LemWatch crawls your website to find broken internal and external links, dead anchors, and 404 pages that hurt SEO and UX.

    Back to Help Center