cipher suites
What it can report
- ✗ high RC4 accepted; prohibited by RFC 7465 and practically broken. How to fix it
- ! medium 3DES accepted; 64-bit block (Sweet32), 112-bit effective strength, below the 128-bit floor. How to fix it
- ! medium TLS 1.2 is accepted only with CBC suites and TLS 1.3 is off, so no client gets an AEAD cipher. How to fix it
- ! medium RSA key exchange accepted. Low when the server prefers forward-secret suites (only legacy clients end up on RSA key exchange); medium when, without TLS 1.3, its first choice for a modern client has no forward secrecy or no forward-secret suite is accepted at all. How to fix it
- · info CBC suites on TLS 1.0/1.1 (BEAST, Lucky13). Informational because the version itself is already penalised by How to fix it
How it counts
The score is computed by fixed rules from the checks that ran, and this check has a weight of 2 within Security. A check that errors or is skipped is shown as "could not check" and left out of the score, never counted as a pass. Fixes and the AI summary are written after scoring and never change it.
Related checks
Scan your own domain and see this check run.