--- title: Free SSL/TLS Grade description: Grade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons. canonical: https://watchfor.io/ssl-grade-checker --- [Back to all free tools](/free-tools) # SSL/TLS Grade Grade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons. [How to use this tool](/blog/how-to-test-your-ssl-tls-grade) Result No result yet Fill in the form above and run it — the result appears here. Monitor this 24/7 — get alerted when a failure is confirmed. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## The SSL/TLS grade scale Every scan returns one of these grades, with the exact reasons behind it. Here's what each one means. A+ Exceptional TLS 1.3, forward secrecy and HSTS, no legacy protocols or weak ciphers. The modern gold standard. A Strong A solid, secure configuration. Usually one step from A+ — often just missing HSTS or TLS 1.3. B Adequate, with weaknesses Works, but has a real weakness: TLS 1.0/1.1 still enabled, or no forward secrecy. C Weak configuration Accepts a weak cipher such as RC4 or 3DES. Old clients still connect insecurely. F Insecure or not trusted Something broken: the certificate isn't trusted (bad chain, expired, or the wrong hostname), SSL 3.0, a NULL/EXPORT cipher, a weak key, or a SHA-1 signature. An untrusted certificate is an F because visitors get a full-page browser warning and most stop there; the report names which trust check failed. ## Every rule, in full A server starts at A+ and each problem can only lower the ceiling, so the grade is always explained by the worst finding in the report. A certificate browsers won't trust is an F, labelled "Not trusted". Rules version tlsgrade-2026.10b . Grade at most When F Certificate not trusted — the chain does not build to a trusted root, or it does not cover the hostname. Browsers show a full-page warning, so nothing else can lift the grade F Certificate expired — the same browser warning as an untrusted chain F SSL 3.0 enabled F A NULL, EXPORT or DES cipher is accepted F RSA certificate key shorter than 2048 bits F Certificate signed with SHA-1, MD5 or MD2 C RC4 or 3DES is accepted C Neither TLS 1.2 nor TLS 1.3 is offered B TLS 1.0 or 1.1 still enabled B The negotiated cipher has no forward secrecy A TLS 1.3 not offered A No Strict-Transport-Security header, or a max-age under 180 days — Certificate expires within 14 days: reported as a warning, not graded — OCSP stapling, CAA record, HTTP/2 and post-quantum key exchange: reported, not graded [How WatchFor grades everything the same way](/grades#ssl-tls) ## What is SSL/TLS Grade ? An SSL/TLS grade is a single letter — A+ down to F — that summarises how well a web server is configured for HTTPS. It rolls up dozens of separate questions (which protocol versions are enabled, whether any broken ciphers are still accepted, whether the certificate chain is trusted, whether connections have forward secrecy) into one answer any engineer, auditor or customer can read at a glance. Made famous by the Qualys SSL Labs SSL Server Test, the letter grade became the industry shorthand for "is this server's TLS set up correctly?". This free SSL/TLS grade checker performs a deep analysis of any public HTTPS server — the same style of test as SSL Labs — and returns the grade plus the exact reason behind every point it costs you. It covers what matters in 2026, including TLS 1.3, post-quantum key exchange (X25519MLKEM768), HTTP/2, HSTS, OCSP stapling and CAA, and returns a fast, shareable report with the reason behind every finding. ## How it works The grade is computed from a full battery of real TLS handshakes against the host — no guessing from banners: - 1 Protocol matrix — We attempt a handshake for each protocol version — TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0 and SSL 3.0 — to see exactly which the server still speaks. Obsolete versions (SSL 3.0, TLS 1.0/1.1) cost points; SSL 3.0 is an automatic fail (POODLE). - 2 Cipher and weak-cipher probing — We record the cipher the server negotiates and then actively offer known-broken suites (RC4, 3DES, DES, EXPORT, NULL) to see whether any are still accepted — the same technique testssl.sh uses. A single weak cipher caps the grade. - 3 Certificate & key — We build the certificate chain to a trusted root, check the hostname, expiry, key type and strength (RSA ≥ 2048, ECDSA, Ed25519) and the signature algorithm (SHA-1 is a fail). A broken chain, wrong hostname or expired cert grades F, labelled "Not trusted" — visitors would see a browser warning, so nothing else can lift it. - 4 Forward secrecy & modern posture — We confirm forward secrecy (ECDHE / TLS 1.3), detect post-quantum key exchange, HTTP/2 via ALPN, OCSP stapling, a CAA DNS record and the HSTS header (and its max-age). These decide whether an A becomes an A+. Every check maps to a plain-language finding, ordered worst-first, so you see what to fix before you see the certificate details. The grading rules are transparent — no black box. ## When you'd use it ### Before and after a TLS change Grade a server before you touch its config and again after — a fast, objective check that you actually removed TLS 1.0 or that RC4 is finally gone, without waiting on a slow external scanner. ### Vendor & security reviews Auditors and procurement teams still ask for an SSL Labs-style grade. Run it in seconds, share the URL, and answer "what's your TLS grade?" with a link instead of a screenshot. ### Chasing an A+ The report tells you exactly what stands between you and A+ — usually "enable TLS 1.3" or "add HSTS with a long max-age" — so you can close the gap instead of guessing. ### Post-quantum readiness Check whether your server (or a vendor's) already negotiates the X25519MLKEM768 hybrid key exchange — the first widely-deployed defence against "harvest now, decrypt later" attacks. Most graders don't report this yet. ## Reading the result ### Protocol versions TLS 1.3 is the current best; TLS 1.2 is still fine. TLS 1.0/1.1 are deprecated and SSL 3.0 is broken — a green badge means the version is supported and safe, a red badge means it's supported but obsolete, and a struck-through badge means it's not offered (which for the old versions is exactly what you want). ### Forward secrecy With forward secrecy (ECDHE or TLS 1.3), each session uses ephemeral keys, so stealing the server's private key later can't decrypt past traffic that was recorded. Its absence caps the grade at B. ### Why an untrusted certificate is an F If the certificate itself isn't trusted — an incomplete chain, an expired cert, or a hostname that doesn't match — the grade is F, labelled "Not trusted". Visitors see a full-page browser warning however good the ciphers are, so no other setting can lift it. The report names which trust check failed, so it never reads like an F for SSL 3.0. WatchFor keeps one A+ to F scale on every grade. ## Common pitfalls ### Grading the load balancer, not the origin For sites behind a CDN or proxy (Cloudflare, Fastly), the grade reflects that edge's TLS, not your origin server's. Grade the origin hostname directly if you need its configuration. ### Assuming a valid cert means an A A perfectly valid certificate still grades B or C if the server also accepts TLS 1.0 or a 3DES cipher. The certificate and the protocol/cipher configuration are graded separately. ### Forgetting HSTS is required for A+ A server can be otherwise flawless and still stop at A because it doesn't send a Strict-Transport-Security header with a long max-age. HSTS is the most common thing between a config and an A+. ## Run SSL/TLS Grade on every change, not just once. Get alerted when an outage is confirmed — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 15 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions How is this different from the Qualys SSL Labs SSL Server Test? It answers the same core questions — protocol versions, cipher strength, forward secrecy, certificate trust, HSTS — and returns the same A+ to F letter grade. What this tool adds: a result in seconds, the exact reason and fix for every point lost, post-quantum key exchange (X25519MLKEM768) and CAA alongside TLS 1.3, HTTP/2, HSTS and OCSP stapling, the same rubric as WatchFor's SSL monitors so the grade can be watched and alerted on, and the result over an API and MCP for automation. What does each grade mean? A+ is an exceptional, modern configuration (TLS 1.3, forward secrecy, HSTS, no legacy protocols or weak ciphers). A is strong. B means it works but has weaknesses like TLS 1.0/1.1 still enabled or no forward secrecy. C means weak ciphers such as RC4 or 3DES are accepted. F means something insecure, like SSL 3.0 or a NULL/EXPORT cipher, or a certificate that isn't trusted (bad chain, expired, or hostname mismatch), which gives visitors a browser warning; the report says which. How do I get an A+? Enable TLS 1.3 and TLS 1.2 only (disable SSL 3.0 and TLS 1.0/1.1), offer only strong forward-secret ciphers (remove RC4, 3DES, DES, EXPORT and NULL), serve a valid certificate chain with a strong key, and send a Strict-Transport-Security (HSTS) header with a max-age of at least 180 days. The report lists whichever of these you're missing. What is post-quantum key exchange and why does it matter? X25519MLKEM768 is a hybrid key-exchange that combines classic X25519 with the ML-KEM post-quantum algorithm. It protects today's traffic against "harvest now, decrypt later" attacks, where an adversary records encrypted data now to decrypt once quantum computers arrive. Modern servers (and Cloudflare, Google) already negotiate it; this checker tells you whether yours does. Does it detect weak ciphers like RC4 and 3DES? Yes. Because these ciphers are so broken that modern TLS libraries refuse to offer them, we send hand-crafted ClientHello messages that specifically offer RC4, 3DES, DES, EXPORT and NULL suites and report which the server accepts — the same active technique professional scanners use. This catches servers that keep legacy ciphers enabled for old clients. Can I check a server on a non-standard port? Yes — set the port field. The grader works against TLS on any port: 8443 for internal admin panels, 993 for IMAPS, 636 for LDAPS, and so on. Use the SNI server name field when the certificate's name differs from the host you connect to. Is my scan private? We run the scan to give you the result and don't publish it. Results aren't listed in any public board; a shareable link is only created if you choose to share one. ## Related web tools - [Software Exposure CheckerSee which software versions your website reveals in its headers and HTML — web server, PHP, CMS, JavaScript libraries — and whether any is outdated, past end of life or has known CVEs. Graded A+ to F, with the fix for each. One plain GET, no signup.](/software-exposure-checker) - [PHP Version CheckerCheck your PHP version, EOL date and known CVEs — php2shell (CVE-2026-109618, CVE-2026-109619) first — from the headers your server already sends. Graded A+ to F, with the exact version to upgrade to. Passive: plain GET requests only, no signup.](/php-version-checker) - [MCP Server CheckerTest a Model Context Protocol server the way an agent does — initialize handshake, protocol version, HTTPS, sign-in discovery and the full tool inventory — and get an A+ to F grade with the exact fix for every problem. Open servers are never marked down for being open.](/mcp-server-checker) - [SSL Certificate CheckInspect certificate validity, expiry, SANs, issuer and chain trust.](/ssl-checker) --- Canonical page: https://watchfor.io/ssl-grade-checker · Site guide: https://watchfor.io/llms.txt