Which TLS version does your site negotiate, and is it current?
The TLS version check reads which protocol version the connection used when the scan read your site. TLS 1.2 or TLS 1.3 passes, and an older version needs attention.
What does this check look at?
It looks at which TLS version the connection used when the scan read your site. Lockpick lists a server that still accepts very old versions of encryption as one of the things that go wrong around the lock.
Pulse and Deep scans both run it.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Pass | The connection used a current protocol version. | Nothing for this connection. |
| Attention | The connection used an older version. | Turn off old versions at your host or load balancer. |
| Not tested | The protocol version was not available to read. | Nothing to act on. |
A modern version on that connection does not prove the server refuses older ones. Proving that older versions are refused needs a dedicated TLS scanner run against your server. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | Someone on the visitor's network |
| The protection that should stop it | A transport setting on the sampled responses |
| What is reached | Traffic between visitors and the site |
| What follows | A hardening gap; no interception was attempted |
Which standards does it relate to?
| Standard | Reference |
|---|---|
| OWASP Top Ten | A04:2025 Cryptographic Failures |
| CWE | CWE-327 |
| ASVS | v5.0.0-12.1.1 |
Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.
Fix it with your AI
Managed hosts set this for you. If your server or load balancer is your own, this prompt points at the right setting.
Check the TLS settings for my site's server or load balancer. Allow only TLS 1.2 and TLS 1.3 and disable TLS 1.0 and TLS 1.1. Tell me where the setting lives for my host, show the change, and remind me to test that older clients I still need can connect.How to check
Say Atlas, our example app at atlas.example, sits on a managed host. The connection uses a current version and the check passes without any change.
The free quick check covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. Pulse or Deep explains the difference.
Questions people ask
My result passed. Does that mean old versions are off?
No. It shows the version this connection used. A server can still accept older ones from clients that ask for them.
Do I need to change anything on Vercel, Netlify or Cloudflare?
Usually not. Those platforms manage TLS versions for you, so this mostly matters for servers you run yourself.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- How we rate findings Lockpick docs, read on October 7, 2026
- The lock in the address bar Lockpick docs, read on October 7, 2026