"Legacy TLS enabled" means your website still accepts TLS 1.0 or 1.1, old encryption versions the IETF formally retired in RFC 8996 in 2021. Current browsers still get modern encryption from your site. Fix it by setting the minimum TLS version to 1.2 in Cloudflare, asking your host, or updating your Nginx or Apache settings, then re-checking.
If your CyberVigil report says your server still accepts TLS 1.0 or 1.1, your site isn't broken, and visitors on current browsers still get modern encryption. The fix is usually a single setting that takes about 10 minutes.
Check your site below. The results show the version your site negotiates and any retired versions it still accepts.
What does "legacy TLS enabled" mean?
TLS (Transport Layer Security) is the encryption behind HTTPS and your SSL certificate. When a browser connects, it and your server agree on the newest version both support. TLS 1.2 and 1.3 are current. TLS 1.0 and 1.1 are much older, and RFC 8996 notes that TLS 1.2 replaced them back in 2008.
Our scan connects to your site normally, then tries again allowing only TLS 1.0, and then only TLS 1.1. If your server accepts either, we show "Worth improving" and list the versions it accepted.
This part of the check is best effort. If we can't test an old version, we don't report it, so a clean result doesn't guarantee the old versions are off.
Why should I turn off TLS 1.0 and 1.1?
In March 2021, the IETF formally deprecated both versions in RFC 8996, which says "TLS 1.0 MUST NOT be used" and "TLS 1.1 MUST NOT be used." It explains that these versions "lack support for current and recommended cryptographic algorithms and mechanisms," and that removing them "reduces the attack surface."
Payment rules point the same way. Cloudflare notes that TLS 1.2 has been the version required by the PCI Security Standards Council since June 2018. If you take card payments on your own site, a TLS 1.2 minimum is the expected setting.
The trade-off is small. Turning off the old versions only affects devices too old to use TLS 1.2. Current browsers already pick 1.2 or 1.3, so they connect exactly as before.
Cloudflare takes a softer line. It sets TLS 1.0 as the default minimum for all customers and suggests considering older versions "for sites with a broad user base, particularly non-transactional sites." That can be reasonable for a large content site with many visitors on old devices. For a small business site with contact forms, bookings or payments, we recommend TLS 1.2.
How do I turn off TLS 1.0 and 1.1?
Change the setting wherever HTTPS connections end. If your site sits behind Cloudflare's proxy, visitors connect to Cloudflare, so change it there. Otherwise, it's your host or your web server.
Instructions for Cloudflare
- 1In the Cloudflare dashboard, select your domain and go to SSL/TLS → Edge Certificates.
- 2Set Minimum TLS Version to TLS 1.2.
- 3The setting applies to the hostnames Cloudflare proxies in that zone. Re-run the scan to confirm.
You could go further and require TLS 1.3 only. Most small businesses shouldn't yet, because TLS 1.2 is still current and some services rely on it. Cloudflare notes, for example, that PayPal's Instant Payment Notification may not support TLS 1.3.
Check the rest of your website setup
Run a free scan to see your certificate, encryption versions, security headers and email settings in one plain-English report.
- Free check
- No signup
- No changes to your website
How do I check that the change worked?
- Re-run the SSL checker. The encryption versions result should no longer list TLS 1.0 or 1.1.
- If you're comfortable in a terminal, Cloudflare suggests this test:
curl https://www.yourbusiness.com -svo /dev/null --tls-max 1.1. If the old versions are off, the connection fails with an error instead of completing. - Cloudflare also warns that a VPN or security software on your computer can block old versions on your end, which makes the test look clean when it isn't. Turn those off for the test, or rely on the scan.
If the scan still flags old versions, the change probably landed on a different layer, such as your server when Cloudflare is in front, or one Nginx server block when another block is the default.
What should you do next?
- Set your minimum TLS version to 1.2, then re-run the free SSL checker.
- While you're in your Cloudflare or server settings, consider turning on HSTS so browsers always use HTTPS.
- If you're not sure where your site's HTTPS is handled, ask your host. It's a quick question for them.
- Run a full website security scan to see your certificate, headers and email setup together.
Common questions
Will turning off TLS 1.0 and 1.1 lock out any customers?
Only people on devices too old to use TLS 1.2, such as very old phones or unsupported operating systems. Current browsers already connect with TLS 1.2 or 1.3, so they won't notice any change.
Cloudflare's default allows TLS 1.0. Is that wrong?
It's a choice, not a mistake. Cloudflare suggests older versions can make sense for broad, non-transactional sites. For a small business site with forms, bookings or payments, a TLS 1.2 minimum follows RFC 8996 and the PCI requirement Cloudflare describes.
Should I require TLS 1.3 only?
Not for most businesses yet. TLS 1.2 isn't deprecated, and some services still depend on it. Cloudflare notes, for example, that PayPal's Instant Payment Notification may not support TLS 1.3. Keep 1.3 turned on and set 1.2 as the minimum.
Does this check cover my email?
No. The scan tests your website's HTTPS connection only. Your email provider controls the encryption versions its mail servers accept, so there's nothing to change there for this finding.
I changed the setting, but the scan still flags it. Why?
The change probably went to a different layer. If Cloudflare proxies your site, visitors connect to Cloudflare, so set it there. On Nginx, a server block can end up using the default server's value, so set ssl_protocols in the http block instead.
Sources
- RFC 8996: Deprecating TLS 1.0 and TLS 1.1 (IETF / RFC Editor)
- Minimum TLS Version (Cloudflare Docs)
- TLS protocols (Cloudflare Docs)
- Module ngx_http_ssl_module (nginx.org)
- Apache Module mod_ssl (Apache HTTP Server Documentation)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.