transport · severity medium
Legacy TLS
Share of TLS endpoints still accepting legacy TLS 1.0 or 1.1.
Measured every Thursday · last updated
How it is measured
Tier 2, via the DomainAPI TLS endpoint, which tests each protocol version explicitly. Denominator: has_web.
Why it matters
Supporting a deprecated protocol version is invisible from the browser — the site loads over TLS 1.3 and looks modern — while the server remains willing to downgrade for anything that asks.
Limits of this measurement
Must be measured server-side. A modern client cannot detect this, because its own OpenSSL refuses to offer TLS 1.0/1.1.
The base rate
Two independent populations. The global, domain-anchored figure is unbiased; the company-anchored figures are built by matching company names to domains and skew toward more digitally-mature firms. Both are published, so the gap is visible.
By company size band
Company-anchored cuts (national registries with a size proxy), split by size band. Right-hand figure is the share not meeting the control.
Every segment
Pick one to see the citable answer for a company like yours, with its trend and methodology.
Show the remaining 61 segments
Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.