---
title: "Why did my SSL grade drop? — Lemwatch Help"
description: "SSL grade drops when a cipher, protocol, or certificate chain changes — here is how to identify the exact cause and fix it."
canonical: "https://lemwatch.com/help/why-ssl-grade-dropped"
source: "https://lemwatch.com"
---

# Why did my SSL grade drop?

> SSL grade drops when a cipher, protocol, or certificate chain changes — here is how to identify the exact cause and fix it.

## Quick answer

 An SSL grade drop almost always means one of four things changed: a weak cipher was re-enabled, TLS 1.0/1.1 came back, the chain is missing an intermediate, or the certificate is near expiry. The Site → Security → SSL panel names the exact rule that failed.

## What triggers a drop

- Weak ciphers re-enabled (3DES, RC4, CBC without AEAD)

- TLS 1.0 or 1.1 accepted

- Missing intermediate certificate in the chain

- Certificate expiring in under 30 days

- Hostname mismatch or self-signed cert on a subdomain

## Where to find it in Lemwatch

 **Site → Security → SSL details**. The grade card shows the exact failed check with a plain-English reason.

## How to fix it

- Open Site → Security → SSL details and note the failing rule.

- If cipher-related, edit your web server config (nginx ssl_ciphers , Apache SSLCipherSuite ) to remove weak suites.

- If chain-related, re-install the certificate with the full intermediate bundle.

- If expiry-related, renew via Let's Encrypt / your CA (see SSL renewals ).

- Click Recheck now — the grade updates within 2 minutes.

## FAQ

### Does Cloudflare "Full (strict)" mode affect my grade?

 Yes — check both Cloudflare's edge cert and your origin cert. Both are graded.

### Why did the grade drop without me changing anything?

 SSL grading standards tighten annually. Old configs stop passing new rules.

## Related

- SSL monitoring

- SSL certificate renewals

- Cloudflare blocking Lemwatch



## Lemwatch at a glance

- What it is: website monitoring that checks uptime, page changes, SEO, security, SSL and speed in one tool.
- Free plan: 10 sites, no time limit, all check types.
- Pro: $19/mo, 50 sites, public API and webhooks.
- Agency: $59/mo, 150 sites, white-label status pages.
- Source: https://lemwatch.com/pricing (facts verified from the product's own plan limits).



## Related

- [Help centre](https://lemwatch.com/help)
- [SSL Certificate Monitoring](https://lemwatch.com/help/ssl-monitoring)
- [SSL & Domain Renewals](https://lemwatch.com/help/renewals-ssl-management)
- [Cloudflare is blocking Lemwatch checks](https://lemwatch.com/help/cloudflare-blocking-lemwatch)
- [Bypassing bot protection for Lemwatch checks](https://lemwatch.com/help/bypassing-bot-protection)
- [How to use the free SSL certificate checker](https://lemwatch.com/help/using-the-free-ssl-checker)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [Embeddable Monitoring Widgets](https://lemwatch.com/help/widget-embeds)