TLS 1.2 and 1.3

TLS 1.2 and TLS 1.3 are the HTTPS protocols your visitors use when the browser locks the connection. On our shared hosting stack with LiteSpeed, TLS 1.3 is available and TLS 1.2 is the lowest version we keep on. TLS 1.0 and 1.1 remain off because they are outdated and unsafe. This is a server setting, not a WordPress plugin switch or an old cPanel checkbox.

What you get on this stack

LiteSpeed already prefers TLS 1.3 and will fall back to TLS 1.2 when a client needs it. Modern browsers and payment processors have spoken TLS 1.2 for years, so most real traffic is fine. You should not paste a long cipher list from an old forum post into the vhost or into .htaccess. That kind of copy-paste often breaks HTTP/2 or TLS 1.3 and creates new SSL Labs noise without helping a single customer.

Handle stragglers without lowering the floor

Before you worry about protocol flags, list any clients that still cannot do TLS 1.2. Old kiosks, legacy WebViews, and aging Java SOAP tools are the usual suspects. Name them, then give them a separate hostname or a replacement path. Do not re-enable TLS 1.0 on the same vhost that takes cards just to keep one device happy.

1. Inventory the stragglers you still care about and write down what each one is.
2. Move those clients to another hostname or update them so they can use TLS 1.2.
3. Leave TLS 1.2 as the floor and keep TLS 1.3 on for everyone else.
4. Re-run the scan you must pass. If it still demands TLS 1.0, replace the scanner.

Ciphers, PCI notes, and what to send us

Cipher order on the LiteSpeed builds we ship is already sensible for normal sites. If a PCI vendor flags a specific cipher, send us the exact name from the report. We will not open TLS 1.0 for one pharmacy kiosk and then watch the scan you actually file fail. A scanner that still insists on TLS 1.0 is a bad scanner, not a reason to weaken the site.

Once protocol versions are settled, you can look at CAA and HSTS as separate layers. A site on TLS 1.3 can still fail on phones if the certificate chain is incomplete. Protocol version alone was never the whole ticket, but keeping TLS 1.2 as the floor and TLS 1.3 preferred is the right baseline here.