---
title: TLS grade on SSL monitors + grade-drop alerts
description: A valid certificate tells you nothing about a cipher suite someone weakened last Tuesday. SSL monitors can now track a daily A+ to F TLS grade (protocols…
canonical: https://watchfor.io/changelog/2026-09-02-ssl-tls-grade-monitoring
---

[All updates](/changelog/page/6#2026-09-02-ssl-tls-grade-monitoring) ✨ New Sep 2, 2026 · v 6.3.9

# TLS grade on SSL monitors + grade-drop alerts

A valid certificate tells you nothing about a cipher suite someone weakened last Tuesday. SSL monitors can now track a daily A+ to F TLS grade (protocols, ciphers, forward secrecy, HSTS and post-quantum key exchange) right on the monitor, and alert you when the grade drops below your target. Enable 'Track TLS grade' in an SSL monitor's settings.

The grade sits on the monitor with the findings that produced it.

## Why grade a monitor

The certificate check tells you the certificate is valid and when it expires. It says nothing about the setup around it. A config change that turns TLS 1.0 back on, or a new load balancer with an older cipher list, passes every certificate check.

## What you get

- A TLS Grade card on the SSL monitor: the grade from A+ to F, the findings behind it, and when the scan ran.

- A daily scan of protocols, ciphers, forward secrecy, HSTS and post-quantum key exchange, graded the same way as the free [SSL/TLS Grade Checker](/ssl-grade-checker).

- A TLS Grade alert preset that opens an incident when the grade falls below the lowest grade you accept.

## Example

Your API has been at A for months. On Tuesday a teammate replaces the load balancer, and the new one also accepts TLS 1.1. The next daily scan grades the server B, the TLS Grade rule fires, and your channel gets "TLS grade dropped below A" with the finding that caused it. Nobody had to remember to run a scan.

## How to turn it on

Open an SSL monitor, switch on Track TLS grade in Settings , then enable the TLS Grade preset on the Alerting tab. The grade is part of some plans; [pricing](/pricing) shows which. How the grade is built: [TLS grade](/docs/monitors/certificates#tls-grade).

Since then: the grade is on by default for new SSL monitors and Check now rescans ([TLS grade: on by default](/changelog/2026-09-03-tls-grade)), the alert asks for a grade instead of a number ([pick a grade](/changelog/2026-09-04-tls-grade-picker)), and an alert clears as soon as the problem is fixed ([TLS grade alerts clear quickly](/changelog/2026-09-08-tls-grade-alerts-clear-quickly)).

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-09-02-ssl-tls-grade-monitoring · Site guide: https://watchfor.io/llms.txt