SSL Labs is a free Qualys scanner that rates how your hostname presents TLS. An A is a solid, practical target for most sites. A+ usually means you also send HSTS with a long max-age and keep the rest of the config tidy. Use the report after the certificate is valid and mixed content is gone, not as a substitute for keeping WordPress and plugins updated.
Read the report in layers
Work through the findings from the bottom up instead of staring at the letter alone. Confirm TLS 1.2 and 1.3 are on, and that TLS 1.0 and 1.1 are off. Check the certificate chain next: leaf plus intermediates, matching name, and dates that have not expired. HSTS should appear only when you are ready to keep the site on HTTPS for every visit. A yellow note about an obscure cipher that modern browsers will not pick is rarely an emergency. SNI problems, the wrong default vhost, and a missing intermediate show up here in plain language, which is where the tool earns its keep.
The letter grade summarizes those layers plus opinions about HSTS preload and cipher order. It does not mean the application itself is patched or safe. An A+ on TLS can still sit in front of an outdated CMS or an abandoned plugin.
When and what to scan
Run SSL Labs after AutoSSL or Let’s Encrypt shows green in cPanel, after you install a paid certificate, or after you change protocol settings. Scan the hostname visitors actually type, with SNI. Scanning a raw IP grades the default vhost and often shows someone else’s certificate. If you terminate TLS at a CDN, the public grade is for the edge, not for LiteSpeed on the origin. Grade the name clients use first, then grade origin separately if you terminate TLS twice.
Do not loop the scanner while pages still load scripts over plain http. The tool grades TLS configuration. It will not grade your PHP, themes, or plugins. When the chain is wrong, fix the chain. When the only gap to A+ is HSTS, that is a deliberate choice after HTTPS has been stable, not a defect you must rush.
Plugins that claim to fix SSL Labs
Many WordPress plugins add security headers you may already send from LiteSpeed or .htaccess. Stacking them can duplicate HSTS, confuse older WebViews, or break a payment iframe. If the server already sends the headers you need, another plugin is a second writer and creates the same class of problem as stacked HTTPS redirects. Prefer one clear place for headers, then rescan once.
Expired certificates fail for a simple reason: they are expired. Renew or reissue first, confirm AutoSSL completed, then run SSL Labs again from the public hostname. Treat the grade as a checklist for protocol, chain, and headers—not as proof that the whole application is secure.
Tagged
Was this article helpful?
Be the first to rate this article.
