Free Online TLS Version Checker
Check which TLS protocol versions a server supports.
| Version | Status | Protocol | Cipher | Note |
|---|---|---|---|---|
| Run a check to see protocol details. | ||||
Results are cached for up to one hour. A version marked unsupported means the handshake was rejected or the version is disabled on the server, not necessarily that the server software lacks support.
About the TLS Version Checker
TLS is the encryption protocol behind HTTPS. When a browser connects to a website, the two sides negotiate a protocol version and a cipher suite before any application data is exchanged. Older versions such as TLS 1.0 and TLS 1.1 have known weaknesses and are deprecated by modern browsers. TLS 1.2 remains widely supported, and TLS 1.3 is the current standard. This checker attempts a handshake for each version and reports whether the server accepted it, along with the negotiated protocol and cipher.
What each version means
- TLS 1.0 and 1.1: deprecated, with weak cipher suites and structural issues. They should be disabled on public servers.
- TLS 1.2: the practical minimum for modern services. It supports strong cipher suites and is accepted almost everywhere.
- TLS 1.3: the newest version, with a shorter handshake, forward secrecy by default, and a reduced set of strong ciphers.
A server can support more than one version simultaneously. The best configuration enables TLS 1.2 and TLS 1.3 while disabling TLS 1.0 and 1.1. Some organizations keep TLS 1.2 only for compatibility with older clients, but that leaves performance and security improvements on the table.
How the check works
The tool sends the hostname to a server-side endpoint. For each protocol version, the server opens a TCP connection to port 443 and attempts a TLS handshake restricted to that version. If the handshake succeeds, the version is supported and the negotiated cipher is captured. If it fails, the version is reported as unsupported, usually because the server rejected it, the connection timed out, or the server is offline. This is a direct handshake test rather than a guess based on banners or certificate metadata.
Limitations
Results are cached for up to an hour to reduce load, so a configuration change may not appear immediately. The test also depends on the PHP build and OpenSSL library on the server running the check; if a version constant is unavailable, the corresponding row explains that. A server behind a load balancer or CDN may behave differently from the origin, and the test does not evaluate certificate trust, HSTS, cipher strength, or application-layer security. It specifically answers the question: which TLS versions does this endpoint accept?
Frequently asked questions
Why is TLS 1.0 shown as unsupported even though the server is old?
The server may have disabled it, or the client library used for the test may refuse to negotiate it. Disabling legacy versions is recommended, so an unsupported result is often a good sign.
Does a supported result mean the site is secure?
No. It only confirms that the protocol version was accepted. Certificate validity, cipher strength, HSTS, and application security are separate concerns.
Why do results differ from another scanner?
Scanners use different client libraries, timeouts, and network paths. A CDN edge may also present a different configuration from the origin server. Compare the hostname and the time of each test.