TLS (Transport Layer Security) is the protocol behind HTTPS; it has gone through several versions, and older ones are now considered insecure.
Current guidance
- TLS 1.0 and 1.1: deprecated — major browsers and payment processors (PCI DSS) no longer allow them
- TLS 1.2: the current minimum baseline, still widely supported and secure when configured correctly
- TLS 1.3: the current best practice — faster handshake and removes several legacy weaknesses
What to do
Configure your server to support TLS 1.2 and 1.3 only, and disable 1.0/1.1 entirely. Most modern web server software (nginx, Apache) defaults to this already on recent versions, but it’s worth explicitly checking, especially on older server installs.
FAQ
Will disabling old TLS versions break anything for visitors?
It can affect a small number of very old browsers or devices, but the security and compliance benefit almost always outweighs that shrinking audience today.