Want to know whether your website is properly encrypted, without installing anything? Enter your domain at gossling.checkfix.io, start the scan, read the grade from A+ to F. Free. What the grade means and what to fix first if it comes back badly is below.
How do I test SSL/TLS online for free?
In four steps:
- Open the tool
Go to gossling.checkfix.io. - Enter your target
Your domain (your-domain.com). For mail servers,smtp://mail.your-domain.comworks too. - Start the scan
Results stream in live, nothing to download. - Read the result
Overall grade first, then the breakdown underneath.
No account, no installation, no shared queue.
What the grade from A+ to F means
Grading follows the system of the Qualys SSL Server Rating Guide. Three areas are weighted into the result:
| Area | Weight | What sits behind it |
|---|---|---|
| Protocol support | 30 % | Which TLS versions the server accepts |
| Key exchange | 30 % | Key exchange strength, forward secrecy, key lengths |
| Cipher strength | 40 % | Which encryption algorithms are on offer |
On top of that come the caps: a single serious finding pulls the grade down regardless of how good everything else looks. Heartbleed means F, TLS 1.0 still enabled caps you at B. That is deliberate. Your encryption is only ever as strong as the weakest algorithm your server still accepts.
The most common reasons for a bad grade
| Finding | What it means | What you do |
|---|---|---|
| SSLv3, TLS 1.0 or TLS 1.1 enabled | Downgrade attacks such as POODLE or BEAST become possible, audit finding under ISO 27001 and PCI DSS | Disable the old protocols, allow only TLS 1.2 and 1.3 |
| Weak cipher suites (RC4, 3DES) | Traffic may be decryptable | Reduce the cipher list to current AEAD suites |
| Incomplete certificate chain | Some clients abort the connection, browsers warn | Install the intermediate certificates on the server |
| Certificate does not match the hostname | Common with subdomains such as ftp or webmail that are missing from the certificate | Reissue the certificate with the correct SAN entries |
| No redirect from HTTP to HTTPS | The first request runs unencrypted, HSTS never takes hold cleanly | Set up a permanent redirect on port 80 |
| HSTS missing | The connection can be downgraded on first contact | Set the Strict-Transport-Security header |
The awkward part: a bad TLS configuration is invisible from the outside. The page loads, the padlock is there. That is exactly the case that led us to build Gossling: a candidate for a security check, unremarkable on the surface, where the TLS assessment kept failing reproducibly. Three weeks later we had our own scanner.
Test your mail server too
Encryption is not a website-only concern. Your mail server also negotiates TLS through STARTTLS, and that is where old protocols and expired certificates sit surprisingly often. SSL Labs only tests publicly reachable web servers. With Gossling you can check smtp:// and imap:// directly, along with HTTPS services on non-standard ports.
What a TLS test does not show you
A good TLS grade is one checkpoint, not a security clearance. It says nothing about whether your web server is carrying a known vulnerability with a CVSS of 9, whether your domain is protected against spoofing through SPF and DMARC, whether a database port is sitting open on the internet somewhere, or whether your security headers actually block clickjacking and XSS.
The full picture comes from the free CheckFix Security Check: five categories in one run, mail security, TLS/SSL, known vulnerabilities, security headers and internet interfaces, with an A to F rating per category. With CheckFix you also get the prioritised ToDo CheckList, the part your technician can actually work from.
How can I test my SSL/TLS encryption online for free?
Use an online scanner such as gossling.checkfix.io: enter the domain, start the scan, read the overall grade from A+ to F. The test runs in your browser, with no installation and no account.
It checks protocols (SSLv3, TLS 1.0 to 1.3), cipher suites, certificates including chain and validity, and known TLS vulnerabilities such as Heartbleed and POODLE. Mail servers can be checked through smtp:// or imap:// as well.
Run the test here: Gossling. The full picture – mail security, security headers, known vulnerabilities, open ports and a ready-made ToDo list to work through – comes from the free CheckFix Security Check.
Conclusion: the test costs you a minute
Most bad TLS grades come from configurations that were correct years ago and have not been touched since. A TLS 1.0 stack still switched on goes unnoticed in daily operation, and gets flagged immediately in the next audit.
Want to compare the free tools before you settle on one? Have a look at our comparison of free SSL Labs alternatives. And what sits behind the warning „SSL obsolete version” is explained here.
TLS is one of five categories. The Security Check shows you the rest.
Sources
- Qualys SSL Labs, SSL Server Rating Guide: ssllabs.com/projects/rating-guide
- RFC 8996, Deprecating TLS 1.0 and TLS 1.1: rfc-editor.org
- RFC 7568, Deprecating SSLv3: rfc-editor.org