What this tool audits
TLS is what makes HTTPS secure, and its strength depends on several moving parts. This audit checks the protocol version the server negotiates, the cipher suite in use, the certificate and how long it has left, whether CAA records restrict who can issue certificates, and the security headers the site returns. Each finding is graded so you get a single letter that reflects the overall posture, plus the detail behind it.
How the grade is calculated
The letter reflects the weakest link, not an average. If the site can't be reached or presents no certificate you get T (trust / unreachable); an already-expired certificate is an F. From there the grade is driven by how many checks fail or warn across protocol, cipher, certificate, and headers: any hard failure caps you at C (one), D (two), or F (three or more), while warnings alone land you at A (a few), B, or B- (many). A clean run — a valid, modern certificate on TLS 1.3 or 1.2 with no header gaps — earns A+. That's why a valid certificate by itself doesn't guarantee a top grade: missing HSTS or weak headers still pull it down.
Frequently asked questions
What TLS version should I be on?
TLS 1.3 is the current best and TLS 1.2 is still acceptable. Anything older than 1.2 is considered insecure and should be disabled. The audit flags the version the server negotiates.
What are CAA records and why do they matter?
CAA records list which certificate authorities are allowed to issue certificates for your domain. Without them, any CA can issue a cert for you, which widens the attack surface. Adding them is a quick, low-risk win.
Why did I get a lower grade than expected?
The grade combines protocol, cipher, certificate health, and headers. A valid certificate alone is not enough. Missing HSTS, weak headers, or no CAA records all pull the grade down. The checklist shows exactly what to improve.