How to Improve Your SSL/HTTPS Grade
Your report shows a letter grade (A+ to F) built from eight factors on a 100-point scale. Fix the failed factors first — that is faster than chasing every optional enhancement. Full thresholds live on our methodology page; this guide is the practical map from factor → how-to.
Key takeaways
- Open the report factors list and work top-down by points lost.
- Invalid certificate hard-caps at F; missing redirect with port 80 serving content caps at C.
- A+ needs a near-perfect score plus HSTS preload eligibility/list, CSP, and TLS 1.3 — not only “HTTPS works.”
- Mixed content and OCSP stapling matter for users but are separate from the letter grade.
Factor → fix
HTTPS Connection (25 pts)
HTTPS must answer. Fix DNS, firewall, or certificate errors that block TLS.
Fix SSL certificate errorsHTTP to HTTPS Redirect (20 pts)
Port 80 should 301 to HTTPS when it is reachable.
Fix HTTP → HTTPS redirectValid SSL Certificate (20 pts)
Cert must be in date and cover the hostname (watch chains and SAN).
Fix incomplete certificate chainCertificate Not Expiring Soon (10 pts)
More than 14 days left. Automate renewal (e.g. certbot) before LE’s ~30-day window.
Renew and fix certificatesModern TLS (no 1.0/1.1) (10 pts)
Disable TLS 1.0 and 1.1; keep 1.2 and 1.3.
Disable TLS 1.0/1.1Short Redirect Chain (5 pts)
Prefer at most three hops; avoid loops and www/HTTPS ping-pong.
Fix redirect loopsHSTS Enabled (5 pts)
Send Strict-Transport-Security with a positive max-age.
HSTS and preload guideSecurity Headers (5 pts)
Pass at least four of six headers, including Content-Security-Policy.
Set security headers
Also check (not always in the grade)
- Mixed content — breaks the padlock even with a valid cert.
- OCSP stapling — informational on our report; still good for latency and privacy.
- HTTP/2 and HTTP/3 — performance, not the SSL letter grade.
Re-test
After each change, run the checker again (or wait for monitoring). Grades update when the stored report is refreshed.
Free HTTPS checker