Having an HTTPS certificate is only the start. Old TLS versions, weak cipher suites, expiring certificates and a missing HSTS header can all leave traffic open to interception.

How it happens

Servers often keep TLS 1.0 and 1.1 enabled for compatibility, allow weak ciphers, or serve the first visit over plain HTTP. An attacker on the same network, for example on public Wi-Fi, can downgrade or intercept the connection.

Why it matters

• Interception of logins, sessions and personal data.
• Browser warnings and lost trust when a certificate expires.
• Failing PCI DSS and similar requirements that mandate strong TLS.

How to prevent it

• Disable TLS 1.0 and 1.1; support TLS 1.2 and 1.3 only.
• Use modern cipher suites with forward secrecy.
• Send Strict-Transport-Security with a long max-age, and consider preload.
• Monitor certificate expiry and automate renewal.
• Mark cookies Secure so they are never sent over HTTP.

How Vooki Pro helps

• Checks for deprecated TLS versions (1.0 and 1.1), weak ciphers, certificate problems and upcoming certificate expiry.
• Checks HSTS and HSTS preload readiness.
• Flags cookies missing the Secure flag and mixed content.
• Maps TLS findings to PCI DSS v4.0 in compliance reports.

Frequently asked questions

Should I disable TLS 1.0 and 1.1?

Yes. They are deprecated and fail PCI DSS requirements. Support TLS 1.2 and 1.3 only.

What does HSTS do?

Strict-Transport-Security tells browsers to use HTTPS for your site on every visit, preventing downgrade and cookie-stealing attacks on the first request.

Related: A practical guide to Content Security Policy (CSP) · Secure cookie flags: Secure, HttpOnly and SameSite