Which TLS versions should be on?
- TLS 1.3: on. It is faster (one round trip fewer) and only allows strong ciphers.
- TLS 1.2: on, for older clients and API libraries.
- TLS 1.0 and 1.1: off. Every major browser dropped them in 2020, PCI DSS forbids them, and Ubuntu 26.04's Apache disables them by default.
In Nginx: ssl_protocols TLSv1.2 TLSv1.3;. In Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3. Caddy already uses only TLS 1.2 and 1.3.
HTTP/2, HTTP/3 and HSTS
For HTTPS ports the check also makes one request to see which HTTP version the server negotiates, whether it advertises HTTP/3 (QUIC) in its Alt-Svc header, and whether it sends Strict-Transport-Security. HTTP/3 itself can't be tested from Cloudhim’s server; an h3 entry in Alt-Svc is what browsers use to switch.
How it is tested
For each version, Cloudhim’s server opens a connection and offers only that version, so the result shows exactly what the server accepts, not just what it prefers. The certificate isn't validated here: use the SSL Certificate Checker for that. Results are kept for two minutes.