webzod
account

Turn off TLS 1.0 and 1.1 on Cloudflare

tls.protocols.legacy_enabled · effort: minutes

Why it matters

TLS 1.0 and 1.1 are deprecated and no current browser uses them, but leaving them on lets attackers and old tools negotiate weaker encryption. Turning them off costs almost nothing today.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Open SSL/TLS then Edge Certificates in the zone, find Minimum TLS Version and choose TLS 1.2.
  2. The setting applies to visitors on proxied (orange cloud) hostnames. Clients that cannot speak TLS 1.2 are refused.
  3. Verify afterwards with the openssl commands in the generic entry. A per-hostname version needs Advanced Certificate Manager.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.