Defaults.Exposed › October 2026 census › v10 registry › TLS version
TLS version
Methodology v10 · canonical ID tls-version · TLS (Transport Layer Security) & Certificates · scored
Modern TLS (1.2/1.3); old versions are broken and fail security reviews.
TLS version: definition
| Canonical ID | tls-version |
|---|---|
| Category | TLS & Certificates |
| Grade impact | Scored, counts toward the grade |
| Pass | The server negotiates TLS 1.2 or TLS 1.3. |
| Fail | Only legacy protocol versions (TLS 1.0/1.1 or older) are negotiated. |
| Example (passing) | Negotiated protocol: TLS 1.3 |
TLS version across the census
100.0% of HTTPS-serving domains negotiate TLS 1.2 or 1.3 (220,264,382 of 220,264,382, as of October 12, 2026).
This is a share of the handshakes the census completed, not of every HTTPS (Hypertext Transfer Protocol Secure) host. The scanner offers only TLS 1.2 and 1.3, so a host that speaks nothing newer than TLS 1.0/1.1 fails the handshake and drops out of the HTTPS-serving population entirely rather than appearing here as a failure; legacy-only shares are therefore not enumerable in this rollup.
Aggregates only: never an individual domain's result.
How this check is scored
TLS version is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 112,227,937 of the 332,492,319 graded domains had no determinable result for this check: only completed HTTPS handshakes are counted.
Every outcome in the census
| Outcome | Domains | Share of HTTPS-serving domains | In the headline figure |
|---|---|---|---|
| Negotiated TLS 1.3 | 208,230,719 | 94.5% | Yes |
| Negotiated TLS 1.2 | 12,033,663 | 5.46% | Yes |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of HTTPS-serving domains that negotiate TLS 1.3 by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
The headline measure above reads 100% in every TLD, because the census counts only completed TLS 1.2 and 1.3 handshakes, so this split uses TLS 1.3 alone.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 147,859,634 domains | 95.1% | .wiki 99.2%, .dev 98.9%, .xyz 98.7% | .buzz 65.3%, .vip 90.3%, .work 91.6% |
| Country-code TLDs (ccTLDs): 167 TLDs, 72,019,660 domains | 93.5% | .ng 98.9%, .ai 98.5%, .id 98.2% | .kr 63.1%, .ru 81.0%, .jp 83.4% |
The largest TLD in this base, .com, stands at 94.9% (96,375,133 of 101,602,779).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 219,879,294 of the 220,264,382 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 6 TLS & Certificates checks with a published figure, TLS version has the 1st highest pass share. Next below it is Key strength: 99.9% of domains whose certificate key could be read. Across every check with a published figure it ranks 1st of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix Modern encryption
Cite this check
Defaults.Exposed, "TLS version (tls-version)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/tls-version
Permalink: https://defaults.exposed/methodology/tls-version ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data