How-to
TLS Weak Protocol Detector
Detect traffic using outdated TLS 1.0/1.1 protocols that may indicate legacy clients or misconfigured scrapers.
1 min readLast updated 26 April 2026
Jump to section
What it detects
The TLS weak protocol detector alerts when a configurable percentage of your traffic uses outdated or insecure TLS protocols:
- TLS 1.0 — deprecated since 2020, known vulnerabilities (BEAST, POODLE)
- TLS 1.1 — deprecated since 2020, no modern security features
- "none" — requests with no TLS (plain HTTP, if applicable)
Why it matters
A healthy modern storefront should see 99%+ of traffic on TLS 1.2 or 1.3. If TLS 1.0/1.1 traffic suddenly appears above your baseline, it could indicate:
- Misconfigured scrapers using old HTTP libraries that default to TLS 1.0
- Legacy integration partners sending automated requests with outdated clients
- Compliance risk — PCI DSS 4.0 requires TLS 1.2 minimum
Default thresholds
| Parameter | Default | Description |
|---|---|---|
window_minutes | 60 | Time window to evaluate |
weak_ratio_threshold | 0.01 (1%) | Percentage of traffic on weak protocols |
min_requests | 1000 | Volume floor |
weak_protocols | TLSv1, TLSv1.1, none | Which protocols count as "weak" |
Severity
- Info: 1-5% weak traffic
- Warning: 5-10% weak traffic
- Critical: 10%+ weak traffic