STATUS IS UPWEBSITE READINESS
Owner workspace
Explore SIU

Readiness check · Harden lane · weight 6

TLS 1.3 negotiated

A standard TLS client connecting to the host negotiates TLS 1.3.

Observed on
91%

of 39,230 measured sites

Top 1K sites
93%

469 measured

Top 1M band
93%

5,471 measured

Not measured
865

blocked, challenged or not applicable

Why it matters

TLS 1.3 removes legacy cipher suites and completes the handshake in fewer round trips, so it is both safer and faster for new connections.

How to fix it

Enable TLS 1.3 on your CDN or server. Keep TLS 1.2 available for older clients unless you have checked your audience.

How we check

A standard TLS client connecting to the host negotiates TLS 1.3.

Observed: TLS 1.3 negotiated.

Not observed: Connection used an older TLS version.

Limit: Certificate and protocol were observed from one vantage point; CDNs can present different certificates by region.

Stack-specific steps

  • Cloudflare: Turn on TLS 1.3 under SSL/TLS > Edge Certificates.
  • Nginx: Use ssl_protocols TLSv1.2 TLSv1.3; with a current OpenSSL build.

By popularity band

Chrome UX Report bandObservedMeasured
Top 1K93%469
Top 5K92%2,093
Top 10K91%2,481
Top 50K90%18,312
Top 100K91%5,152
Top 500K92%5,252
Top 1M93%5,471

Categories most likely to do this

Categories least likely

By stack

By provider

Popular sites where we observed this

Sources and guides

Guide: HTTPS and TLS Guide for Website OwnersCheck your own site