On SSL Labs, the difference between an A- and an A+ can be one HTTP response header.
Not a better certificate. Not a stronger key. Not a rearchitected handshake. Since the rating guide’s May 2025 revision, a server that sends no HSTS header is held at A-. Add Strict-Transport-Security with a max-age of at least six months — 15768000 seconds, one line — and, if nothing else draws a warning, your grade goes from very good to perfect. That jump gets celebrated like a shipped security feature. It’s a header.
I don’t say this to sneer at SSL Labs. It’s a genuinely good tool, and it’s been the reference for TLS configuration since Ivan Ristić built it in 2009. When I need to know whether a server negotiates modern protocols, keeps a clean certificate chain, and hasn’t left RC4 or an incomplete chain lying around, SSL Labs is where I look. The grade is honest about the thing it grades. The problem is what people believe the grade means, and the belief is wildly larger than the measurement.
What the grade actually scores
SSL Labs computes three numbers and averages them with fixed weights: protocol support at 30%, key exchange at 30%, cipher strength at 40%. There’s also a certificate check that acts as a gate — a bad cert can fail you outright. Score 80 or higher and you get an A. Below that it slides to B, C, D, and down.
Then come the caps, and the caps are the interesting part. Support TLS 1.0 or 1.1 and your grade is capped at B no matter how good everything else is. No forward secrecy: capped at B. No AEAD ciphers: B. RC4 anywhere: B. Weak Diffie-Hellman parameters under 2048 bits: B. An incomplete certificate chain: B. No TLS 1.3: capped at A-. No valid HSTS header: A-. The scoring is really a checklist of known-bad configurations wearing a numeric costume. Avoid every item on the naughty list and you land in the A range. That’s the whole game.
Which is fine — avoiding known-bad TLS config is worth doing, and plenty of servers still don’t. But look at what’s being measured. Every single input is a property of the channel: the protocol version, the cipher, the key exchange, the chain. Not one of them is a property of the thing on the other end of the channel.
The rating guide says this itself, in plain text most people never read: SSL “does not and cannot address a number of possible security issues.” It’s talking about the application. Session handling, authentication logic, injection, the actual software serving the bytes — none of it is in scope, because none of it is visible from a TLS handshake. SSL Labs measures the pipe. It says nothing about what flows through it.
A phishing kit gets an A+
Here’s the demonstration that should end the argument. A phishing site — one built to steal your bank login, hosted this morning on a throwaway domain — can easily score an A or A+ on SSL Labs.
Of course it does. It gets a free certificate from Let’s Encrypt in about twenty seconds. It sits behind Cloudflare or a modern host that negotiates TLS 1.3 with AEAD ciphers and forward secrecy by default. It adds the HSTS header because the tutorial said to. Every input SSL Labs looks at comes back clean, because the criminal is using the same 2026-default infrastructure your bank uses. The channel to the phishing page is impeccably secured. It’s the destination that’s a felony.
This isn’t a knock on SSL Labs. It’s the point. The grade certifies transport, and transport to a fraud site is still good transport. But the padlock-adjacent instinct — A+ means safe — is exactly the misread the grade invites, and the industry leans into it. “SSL Labs A+” shows up in vendor security pages, in RFP responses, in compliance evidence, as if it were a statement about the organization rather than a statement about its TLS parameters.
The one-header tell
Go back to that one header. The reason that gap bothers me so much is that it’s the grade admitting its own ceiling.
By the time that header is the only thing between you and the top grade, you’ve done the substantive work: modern protocols, strong ciphers, forward secrecy, a valid chain. Everything TLS configuration can meaningfully express, you’ve expressed. So what does the top grade, the one everyone actually wants, add on top? HSTS with a long max-age and the absence of any warnings. A directive telling browsers to refuse plaintext next time. It’s a good header. I recommend it. But it is not a new tier of security — it’s the same channel with a sticky note asking browsers to remember it’s HTTPS.
When the distance between “very good” and “the best possible” is a single response header, the scale has run out of things to measure. That’s not a flaw you fix by adding more grades. It’s the honest edge of what an external TLS scan can see. The A+ is the highest score a peephole can give you.
So what is it good for
The grade earns its keep as a regression alarm and a floor.
As a floor, “get every server to at least an A” is a fine engineering directive. It rules out a specific, well-understood set of TLS mistakes, and a fleet that all scores A has genuinely fewer channel-level footguns than one that doesn’t. As a regression alarm, it’s even better: if a server was A+ last quarter and it’s a B today, something changed — a protocol got re-enabled, a chain broke in a deploy, a cipher config drifted. That delta is a real signal worth alerting on.
What it is not is a security posture. It’s not evidence your application is safe, your authentication is sound, or your data is protected from anything except passive eavesdropping on the wire. Those are the failures that actually get people breached, and they are all invisible to a handshake.
I’d make one change if I could, and it’s not to the scoring. It’s to the culture around it. Stop treating A+ as an achievement and start treating A as the baseline it is — the price of admission, not a trophy. An organization that leads with its A+ is often leading with the security work that’s cheap to do and easy to show. The expensive, invisible work — the work no external scanner will ever grade — is the work that decides whether the A+ meant anything at all.
The padlock told users a lie for years: that encrypted meant trustworthy. The A+ tells professionals a smaller, more sophisticated version of the same lie. Configured-well is not the same as safe. It never was. It’s just easier to measure.