Score Breakdown

Detailed SSL/TLS score analysis breakdown

Domain

Port

Results

About

The SSL Security Score Breakdown tool provides a detailed analysis of your domain's SSL/TLS security configuration, assigning individual scores across multiple security dimensions. It evaluates your certificate strength, protocol support, cipher suite configuration, key exchange security, and header configuration to calculate an overall security score from 0 to 100.

Each scoring category includes specific recommendations for improvement, making it easy to prioritize hardening efforts. The breakdown shows exactly which areas are pulling your score down — whether it's weak ciphers, missing HSTS, outdated protocols, or certificate issues. This granular visibility helps you make targeted improvements rather than guessing what needs fixing.

How to Use

1Enter the domain name you want to evaluate (e.g., example.com)
2Click "Get Score Breakdown" to run the comprehensive security analysis
3Review the overall score and individual category scores (Certificate, Protocols, Ciphers, Headers)
4Follow the specific recommendations for each category to improve your security score

Use Cases

•Security Baseline: Establish a quantitative security baseline for your domain and track improvements over time after hardening changes
•Executive Reporting: Generate security score reports for management that clearly communicate TLS security posture in a simple 0-100 format
•Remediation Prioritization: Identify the highest-impact improvements to focus development effort where it will most improve security
•Competitive Benchmarking: Compare your security score against industry standards and competitors to identify gaps
•Compliance Evidence: Document security scores as evidence of TLS configuration quality for PCI DSS, HIPAA, and SOC 2 audits

Where The Points Come From

Four components, each measured on one connection. Two of them were constants until recently, which meant the breakdown looked detailed while ignoring half the input.

1Protocol and cipher come from the negotiated version and suite, scoring highest for 1.3 with an AEAD cipher and lowest for old protocols with CBC.
2Key exchange is derived from the suite name now rather than a fixed value: full marks on 1.3 where forward secrecy is unconditional, high for ECDHE or DHE, low for static RSA.
3The certificate score comes from its live expiry date — zero once expired, rising through the final weeks, full beyond ninety days. It previously held a fixed value regardless of the certificate.

The overall score averages only these four measured components. It describes one connection, which makes it a good before-and-after comparison and a poor substitute for a configuration review.

Tips & Best Practices

•Focus on improving the lowest-scoring category first for the biggest overall score improvement
•Aim for a score above 90 for production systems handling sensitive data
•Re-run the score breakdown after each hardening change to measure improvement
•Use the category scores to create targeted security improvement roadmaps

Technical Details

●Scoring Categories: Certificate (25%), Protocol Support (25%), Cipher Strength (25%), Security Headers (25%)

●Weighted Algorithms: Each category uses weighted scoring based on security impact and industry best practices

●Thresholds: 90-100 Excellent, 80-89 Good, 70-79 Fair, 60-69 Poor, Below 60 Critical

●Recommendations: Specific, actionable fix suggestions for each sub-category with estimated score improvement

Frequently Asked Questions

A score of 90-100 is excellent and indicates your TLS configuration meets modern security best practices. Scores of 80-89 are good but have room for improvement. Below 80 indicates significant security gaps that should be addressed. For PCI DSS compliance, aim for at least 80. For high-security environments handling financial or healthcare data, target 90+.

The fastest improvements usually come from: enabling HSTS headers (can add 10-15 points), disabling TLS 1.0/1.1 (5-10 points), removing weak ciphers like RC4 and 3DES (10-20 points), and ensuring your certificate chain is complete and properly ordered (5-10 points). These changes are typically low-risk and high-impact.

Check your score after any TLS configuration change, at least monthly for routine monitoring, and quarterly for compliance documentation. Set up the API integration to automatically track score changes over time and alert you if your score drops due to configuration drift or new security standards being applied.

Because those components measure the connection and the certificate component measures the certificate. They are separate facts, and an expired certificate does not make a TLS 1.3 handshake worse — it just makes the certificate invalid. Reading them separately tells you whether the problem is transport configuration or lifecycle management, which are fixed by completely different people and processes.

Granularity and the components included. This page breaks a score into protocol, cipher, key exchange and certificate, which is useful when you want to know which change would help most. The score page adds security headers as a measured component. Both average their measured parts only, and both describe a single connection rather than your whole configuration.

Because they are different properties with different failure modes. A strong cipher with static RSA key exchange gives excellent confidentiality now and total loss of confidentiality if the key is compromised later. Scoring them together would let one high value hide the other, and improving one does not fix the other — so they are tracked independently.

Most likely because the certificate score changed with the new expiry date. A newly issued certificate with a shorter remaining lifetime scores lower than one with ninety days remaining, which is correct arithmetic on a metric about remaining time rather than about quality. If the certificate component is the only one that moved, nothing has actually got worse — the renewal simply reset the clock.

Fix specific findings. The score is a convenient summary for a dashboard, but it compresses four independent measurements into one number, and two changes of different value can produce the same movement. Use it to notice that something changed, then use the component that moved to understand what happened. Optimising the number itself tends to produce changes that do not improve the underlying position.