TLS
TLS 1.0 and 1.1: turn them off. Here's why and how.
Published 2026-04-18 · Last updated 2026-04-18 · Vantyris editorial
If your web server still accepts TLS 1.0 or 1.1, it's offering connection security from 1999 and 2006 respectively. Every modern browser refuses to use either. Leaving them enabled helps nobody. It lowers your security grade and gives compliance auditors a reason to fail you. The fix is one line in your host's SSL config.
What this means for your business
- TLS 1.0 (1999) and TLS 1.1 (2006) have known cryptographic weaknesses. The four major browsers (Chrome, Firefox, Edge, Safari) all removed support for them in 2020-2021. Any visitor reaching your site through a modern browser is already negotiating TLS 1.2 or 1.3.
- If you leave TLS 1.0/1.1 enabled, the only clients still using them are very old systems (Windows XP IE, Android 4) and security testers running compliance checks. Most frameworks, PCI DSS and HIPAA among them, explicitly require disabling them.
- TLS 1.3, released in 2018, is the current standard. It's faster (one fewer round trip during the handshake) and drops weak cipher suites that 1.2 still allowed.
How to fix
In your web host's SSL settings, set the minimum TLS version to 1.2. If your host doesn't expose this directly, your CDN (Cloudflare's free tier) does.
- Find the TLS minimum-version setting. Cloudflare: SSL/TLS → Edge Certificates → Minimum TLS Version → set to 1.2. Most hosting panels (cPanel, Plesk, Hostinger) have a similar dropdown labelled 'Minimum TLS Version' or 'SSL/TLS Protocols'.
- Disable 1.0 and 1.1. Uncheck or remove those options. Confirm 1.2 and 1.3 remain enabled.
- Test the change. Use ssllabs.com/ssltest or run a Vantyris scan. You should see TLS 1.2 and 1.3 supported, with 1.0 and 1.1 absent.
Owner: Your web host or CDN administrator. · Time: 5 minutes.
Common gotchas
- Don't disable 1.2 'just to be safe' and leave only 1.3. Some legitimate enterprise clients still use 1.2 (older mail servers, some payment integrations). 1.2 is fine. 1.0 and 1.1 are not.
- If your host doesn't let you change this, move the site behind Cloudflare's free tier and set it there. Cloudflare handles TLS termination and gives you the full control panel.
How to verify the fix
ssllabs.com/ssltest will show 'Protocols: TLS 1.2, TLS 1.3' and nothing older. Your overall grade should rise to A or A+.
Cyber Essentials alignment
This finding informs the following Cyber Essentials control areas (the UK government's baseline scheme, a sound checklist in any country):
- A2. Secure configuration: devices and services hardened against the weaknesses they ship with by default.
- A3. Security update management: software stays in vendor support, and high or critical patches go on within 14 days.
Vantyris is not a CE certifying body. The mapping above is informational.
Common follow-up questions
Will disabling old TLS break customers on old browsers?
Almost certainly not. Every major browser had dropped TLS 1.0/1.1 by 2021. The only clients affected are Internet Explorer on Windows XP and Android 4 devices, which together account for under 0.1% of modern web traffic.
Do I need to enable TLS 1.3 specifically?
Yes, ideally. It's faster than 1.2 and has stronger defaults. Most modern hosts have 1.3 enabled by default. If yours doesn't, ask support to turn it on.
What's the difference between TLS and SSL?
TLS is the modern protocol. SSL was its predecessor. People still use the terms interchangeably (we still say 'SSL certificate'), but the protocol actually negotiated is TLS.
References
- RFC 8446: TLS 1.3 IETF RFC
- NCSC: TLS guidance NCSC
- Mozilla SSL Configuration Generator Vendor
Related explainers
- HTTPS for small business: how to enable it in 15 minutes.
- HSTS: the security header that locks HTTPS on for good.
Want Vantyris to check your domain for this and 196 other problems?
The teaser scan is free and needs no card. A verified scan starts at $10€10£10A$15¥1,500AED 40 and comes with the workspace: finding workflow, score trend, three PDF layouts, share links and monitoring.
Written by Vantyris