What this tool audits
TLS is what makes HTTPS secure, and its strength depends on several moving parts. This audit checks the protocol version the server negotiates, the cipher suite in use, the certificate and how long it has left, whether CAA records restrict who can issue certificates, and the security headers the site returns. Each finding is graded so you get a single letter that reflects the overall posture, plus the detail behind it.
Frequently asked questions
What TLS version should I be on?
TLS 1.3 is the current best and TLS 1.2 is still acceptable. Anything older than 1.2 is considered insecure and should be disabled. The audit flags the version the server negotiates.
What are CAA records and why do they matter?
CAA records list which certificate authorities are allowed to issue certificates for your domain. Without them, any CA can issue a cert for you, which widens the attack surface. Adding them is a quick, low-risk win.
Why did I get a lower grade than expected?
The grade combines protocol, cipher, certificate health, and headers. A valid certificate alone is not enough. Missing HSTS, weak headers, or no CAA records all pull the grade down. The checklist shows exactly what to improve.