--- title: Free SSL/TLS Grade description: Grade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons. canonical: https://watchfor.io/ssl-grade-checker --- [Back to all free tools](/free-tools) # SSL/TLS Grade Grade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons. Result No result yet Enter the inputs above and press Run. Results appear here in a moment. Monitor this 24/7 — get alerts on the first failure. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## The SSL/TLS grade scale Every scan returns one of these grades, with the exact reasons behind it. Here's what each one means. A+ Exceptional TLS 1.3, forward secrecy and HSTS, no legacy protocols or weak ciphers. The modern gold standard. A Strong A solid, secure configuration. Usually one step from A+ — often just missing HSTS or TLS 1.3. B Adequate, with weaknesses Works, but has a real weakness: TLS 1.0/1.1 still enabled, or no forward secrecy. C Weak configuration Accepts a weak cipher such as RC4 or 3DES. Old clients still connect insecurely. T Not trusted The certificate isn't trusted — bad chain, expired, or hostname mismatch. Visitors see a browser warning. F Insecure Something broken: SSL 3.0, a NULL/EXPORT cipher, a weak key, or a SHA-1 signature. ## What is SSL/TLS Grade ? An SSL/TLS grade is a single letter — A+ down to F — that summarises how well a web server is configured for HTTPS. It rolls up dozens of separate questions (which protocol versions are enabled, whether any broken ciphers are still accepted, whether the certificate chain is trusted, whether connections have forward secrecy) into one answer any engineer, auditor or customer can read at a glance. Made famous by the Qualys SSL Labs SSL Server Test, the letter grade became the industry shorthand for "is this server's TLS set up correctly?". This free SSL/TLS grade checker performs a deep analysis of any public HTTPS server — the same style of test as SSL Labs — and returns the grade plus the exact reason behind every point it costs you. It goes further than the classic test by also checking the things that matter in 2026: TLS 1.3, post-quantum key exchange (X25519MLKEM768), HTTP/2, HSTS, OCSP stapling and CAA. You get a modern, fast, shareable report instead of a two-minute scan and a wall of tables. ## How it works The grade is computed from a full battery of real TLS handshakes against the host — no guessing from banners: - 1 Protocol matrix — We attempt a handshake for each protocol version — TLS 1.3, TLS 1.2, TLS 1.1, TLS 1.0 and SSL 3.0 — to see exactly which the server still speaks. Obsolete versions (SSL 3.0, TLS 1.0/1.1) cost points; SSL 3.0 is an automatic fail (POODLE). - 2 Cipher and weak-cipher probing — We record the cipher the server negotiates and then actively offer known-broken suites (RC4, 3DES, DES, EXPORT, NULL) to see whether any are still accepted — the same technique testssl.sh uses. A single weak cipher caps the grade. - 3 Certificate & key — We build the certificate chain to a trusted root, check the hostname, expiry, key type and strength (RSA ≥ 2048, ECDSA, Ed25519) and the signature algorithm (SHA-1 is a fail). A broken chain or expired cert grades T (not trusted). - 4 Forward secrecy & modern posture — We confirm forward secrecy (ECDHE / TLS 1.3), detect post-quantum key exchange, HTTP/2 via ALPN, OCSP stapling, a CAA DNS record and the HSTS header (and its max-age). These decide whether an A becomes an A+. Every check maps to a plain-language finding, ordered worst-first, so you see what to fix before you see the certificate details. The grading rules are transparent — no black box. ## When you'd use it ### Before and after a TLS change Grade a server before you touch its config and again after — a fast, objective check that you actually removed TLS 1.0 or that RC4 is finally gone, without waiting on a slow external scanner. ### Vendor & security reviews Auditors and procurement teams still ask for an SSL Labs-style grade. Run it in seconds, share the URL, and answer "what's your TLS grade?" with a link instead of a screenshot. ### Chasing an A+ The report tells you exactly what stands between you and A+ — usually "enable TLS 1.3" or "add HSTS with a long max-age" — so you can close the gap instead of guessing. ### Post-quantum readiness Check whether your server (or a vendor's) already negotiates the X25519MLKEM768 hybrid key exchange — the first widely-deployed defence against "harvest now, decrypt later" attacks. Most graders don't report this yet. ## Reading the result ### Protocol versions TLS 1.3 is the current best; TLS 1.2 is still fine. TLS 1.0/1.1 are deprecated and SSL 3.0 is broken — a green badge means the version is supported and safe, a red badge means it's supported but obsolete, and a struck-through badge means it's not offered (which for the old versions is exactly what you want). ### Forward secrecy With forward secrecy (ECDHE or TLS 1.3), each session uses ephemeral keys, so stealing the server's private key later can't decrypt past traffic that was recorded. Its absence caps the grade at B. ### The T grade T means the certificate itself isn't trusted — an incomplete chain, an expired cert, or a hostname that doesn't match. Visitors see a full-page browser warning regardless of how good the ciphers are, so T overrides the letter scale entirely. ## Common pitfalls ### Grading the load balancer, not the origin For sites behind a CDN or proxy (Cloudflare, Fastly), the grade reflects that edge's TLS, not your origin server's. Grade the origin hostname directly if you need its configuration. ### Assuming a valid cert means an A A perfectly valid certificate still grades B or C if the server also accepts TLS 1.0 or a 3DES cipher. The certificate and the protocol/cipher configuration are graded separately. ### Forgetting HSTS is required for A+ A server can be otherwise flawless and still stop at A because it doesn't send a Strict-Transport-Security header with a long max-age. HSTS is the most common thing between a config and an A+. ## Run SSL/TLS Grade on every change, not just once. Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions How is this different from the Qualys SSL Labs SSL Server Test? It answers the same core questions — protocol versions, cipher strength, forward secrecy, certificate trust, HSTS — and returns the same A+ to F letter grade. It differs by being faster (seconds, not minutes), showing the exact reason for every point lost, and additionally checking 2026-era signals SSL Labs doesn't report: TLS 1.3, post-quantum key exchange, HTTP/2 and OCSP stapling. It also exposes the same result over an API and MCP for automation. What does each grade mean? A+ is an exceptional, modern configuration (TLS 1.3, forward secrecy, HSTS, no legacy protocols or weak ciphers). A is strong. B means it works but has weaknesses like TLS 1.0/1.1 still enabled or no forward secrecy. C means weak ciphers such as RC4 or 3DES are accepted. T means the certificate is not trusted (bad chain, expired, or hostname mismatch) — visitors get a browser warning. F means something insecure, like SSL 3.0 or a NULL/EXPORT cipher. How do I get an A+? Enable TLS 1.3 and TLS 1.2 only (disable SSL 3.0 and TLS 1.0/1.1), offer only strong forward-secret ciphers (remove RC4, 3DES, DES, EXPORT and NULL), serve a valid certificate chain with a strong key, and send a Strict-Transport-Security (HSTS) header with a max-age of at least 180 days. The report lists whichever of these you're missing. What is post-quantum key exchange and why does it matter? X25519MLKEM768 is a hybrid key-exchange that combines classic X25519 with the ML-KEM post-quantum algorithm. It protects today's traffic against "harvest now, decrypt later" attacks, where an adversary records encrypted data now to decrypt once quantum computers arrive. Modern servers (and Cloudflare, Google) already negotiate it; this checker tells you whether yours does. Does it detect weak ciphers like RC4 and 3DES? Yes. Because these ciphers are so broken that modern TLS libraries refuse to offer them, we send hand-crafted ClientHello messages that specifically offer RC4, 3DES, DES, EXPORT and NULL suites and report which the server accepts — the same active technique professional scanners use. This catches servers that keep legacy ciphers enabled for old clients. Can I check a server on a non-standard port? Yes — set the port field. The grader works against TLS on any port: 8443 for internal admin panels, 993 for IMAPS, 636 for LDAPS, and so on. Use the SNI server name field when the certificate's name differs from the host you connect to. Is my scan private? We run the scan to give you the result and don't publish it. Results aren't listed in any public board; a shareable link is only created if you choose to share one. ## Related web tools - [MCP Server CheckerTest a Model Context Protocol server: initialize handshake, protocol version, capabilities and the full tool inventory.](/mcp-server-checker) - [SSL Certificate CheckInspect certificate validity, expiry, SANs, issuer and chain trust.](/ssl-checker) - [HTTP HeadersInspect response headers, status, redirect chain and security headers.](/http-header-checker) - [API TesterSend a real HTTP request from a probe and inspect the response — status, headers and every JSON field.](/api-tester) --- Canonical page: https://watchfor.io/ssl-grade-checker · Site guide: https://watchfor.io/llms.txt