TLS vs SSL: Which Protocol Should You Use?

If you’re a website owner, you probably want to know how to make your site as secure as possible. Securing your website and converting it to HTTPS should be a priority. You have likely heard two terms floating around that are essential to getting you there: TLS vs SSL. What do they mean? Is one better than the other? Which should you use to have the most secure website you can?

Let’s break down the differences and similarities between the protocols, and work through what you should be doing to secure your website.

What are SSL and TLS?

Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are both security protocols that help to protect data and make your website safer for the end-user. Both protocols result in end-to-end encryption between the site and the user’s device. This builds trust with users and search engines alike. Whether you use TLS vs SSL to secure your site, you’re protecting your own data and (maybe more importantly) that of your users from potential hacking or malicious activity.

Website owners obtain both TLS and SSL certificates in order to convert a website from HTTP (hypertext transfer protocol) to HTTPS (hypertext transfer protocol secure). When a website is secure, it displays a secure lock icon in a user’s browser address bar. Having a security certificate for your website tells browsers that it’s safe for a user to access, giving the user peace of mind that their information is safe.

Every website needs a TLS or SSL certificate. It helps in search rankings as well as protection from hackers and other compromising situations. But it’s especially important if you’re using your website to process payment information or to store sensitive records. It’s just one piece in your puzzle for full, locked-down site security, but it’s a critical one.

What’s the Difference Between TLS vs SSL?

In terms of results, TLS and SSL offer the same thing: encrypted security for your website. You’re likely to hear the terms used interchangeably in reference to the certificates. Although technically, TLS and SSL are not the same. Both protocols use a process called a handshake to initiate an encrypted connection. Basically, the two machines ask to see the other’s ID, and when it checks out, they can do business.

That’s where the technical similarities end. Each cryptographic protocol functions in a different way to reach the same end result.

In a nutshell, the current standard of TLS 1.3 vs SSL (and older TLS standards) include reducing latency to promote faster load times, which is imperative these days for every site out there, removing legacy code bloat to lower the number of vectors someone might attack your site, and using a single handshake between points rather than multiple which again lowers the vectors someone might compromise your security.

SSL, first released in 1995, is the predecessor of TLS. All three iterations of SSL have since been found lacking when it came to security vulnerabilities. In fact, the first version was never released publicly. Later, the Internet Engineering Task Force (IETF) deprecated all versions of SSL.

Even so, the term SSL is still widely used for describing the security certificates website users need to obtain. But in most cases, the actual protocol being executed behind the scenes is TLS. Today, versions 1.2 and 1.3 of TLS are the only versions of either protocol (TLS vs SSL) that have not yet been deprecated by the IETF or major browsers. If your website is using TLS 1.1 or 1.0, browsers such as Chrome will display a ERR_SSL_OBSOLETE_VERSION warning. If you want to read more about the technical intricacies of TLS 1.3 and how it works, Cloudflare has an excellent post articulating the specs.

Should Your Website Have TLS or SSL?

Over the years, SSL has been nearly entirely replaced by TLS. Even though you’ll still see “SSL certificates” referred to more often than TLS ones, the underlying protocol in use is likely going to be TLS. Regardless of what it’s called.

Your website should have TLS in use since it’s now the IETF-approved standard protocol for website security. A good web host will provide SSL certificates with hosting (or you might get one yourself elsewhere), it will probably still function through that TLS protocol regardless of being called SSL. If you’re aiming for top WordPress security, then you need to make sure your bases are covered here.

Because of various security issues, SSL and older versions of TLS need to be disabled on the server-side of your website. If you aren’t comfortable with working on the server yourself, you might want to ask your website host or a developer to help you out. After all, that’s what you pay them for! Making sure that deprecated versions of SSL and TLS prevents older protocols from being enabled further protects your website from security threats and intrusions.

What About Both?

Because of the similarities, history, and somewhat baffling naming conventions, you might be wondering whether website owners need both an SSL and TLS certificate to properly secure their sites. Nope! These days, SSL and TLS certificates do the same thing. The certificate itself doesn’t provide security for your website. Instead, it just enables the TLS protocol in the background to do its job. Which goes further to explain why the naming conventions are muddy—to keep things more consistent with what people are used to hearing.

How to Use TLS and SSL on Your WordPress Website

Using TLS and SSL on your WordPress website is fairly easy. First, you’ll need to get the certificate (most often referred to as an SSL certificate, as we’ve mentioned). There are both paid and free options available. That means you can get a certificate in a way that works best for your budget and for the type of website that you run. You might be in an industry that requires a tighter level of security and control than a free certificate can offer. If that’s the case, you would want to seek out a paid SSL certificate.

There are a few different ways to get an SSL certificate for your WordPress website. All of which are pretty easy.

• Get a free SSL certificate from a source such as ZeroSSL or SSL For Free (these will need to be manually renewed every 90 days and lack in-depth customer service support).
• Purchase web hosting from a company that provides an SSL certificate as part of your hosting package with hosts like SiteGround, Flywheel, and Pressable.
• Amp up your site security by using a CDN such as Cloudflare.
• Use a WordPress plugin like Really Simple SSL to implement your SSL certificate.

Once you’ve got the certificate in place, you’ll want to make sure all your links redirect to your HTTPS site rather than HTTP. Google might penalize you for having an insecure site if you don’t. This ensures you don’t get flagged you when users attempt to access your site. There are WordPress plugins you can use to accomplish this, such as WP Force SSL & HTTPS Redirect. Alternatively, you could ask your web host or a developer for help with properly configuring your server to redirect to HTTPS. Some 301 redirect plugins and SEO plugins also offer this functionality directly in their settings.

Conclusion

When you catch references to TLS vs SSL and one being different, they’re both right and wrong. The technical specs are different, but the names are interchangeable these days. Essentially, they’re referring to a standard that provides the same end result. The TLS protocol has replaced SSL because it’s faster and more secure. However, the names TLS and SSL remain interchangeable in reference to security certificates.

Remember, WordPress security using TLS is relatively straightforward and nowhere near as confusing as the names and .

Now that you know which protocol to use, it’s time to secure your website. Good luck!

Article featured image by MicroOne / shutterstock.com