SSL Checker and HTTPS Test
The SSL FREAK Test checks whether your server is vulnerable to the FREAK attack (CVE-2015-0204) by accepting export-grade RSA cipher suites.
- Results in seconds
- Pass / fail + fix guidance
- No account required
The SSL FREAK Test checks whether your server is vulnerable to the FREAK attack (CVE-2015-0204) by accepting export-grade RSA cipher suites. FREAK was disclosed in 2015 and modern servers should have disabled export ciphers years ago — but legacy or poorly maintained servers occasionally still negotiate them, exposing TLS connections to a downgrade attack that breaks confidentiality. This test confirms your server refuses export-grade ciphers entirely.
What This Tool Checks
- Server response to export RSA cipher offer
- Server cipher suite list
- TLS protocol versions supported
- Cipher strength (RSA bit-length, ECDHE preferred)
- Forward secrecy availability
Why It Matters for SEO
FREAK is now over a decade old, but unmaintained servers and embedded devices still occasionally accept export ciphers. A server that does silently downgrades client connections to a 512-bit RSA key — broken in hours on commodity hardware. Modern TLS configuration disables export ciphers entirely; this test confirms that disablement on your live server.
How to Fix It
Use a modern TLS cipher list (Mozilla SSL Configuration Generator is the standard reference). Explicitly disable EXPORT and DES ciphers. Patch the underlying OpenSSL / TLS library. Re-test after any config or library change.
How It Works
We open a TLS handshake offering export-grade RSA cipher suites. A vulnerable server accepts the offer and negotiates a weak connection; a properly configured server refuses with a handshake failure. The result is a binary pass / fail.
Common Mistakes to Avoid
- Out-of-date OpenSSL version with export ciphers enabled
- Embedded device or appliance with frozen TLS config
- Custom cipher list copied from old documentation
- Treating older CVEs as "fixed by default" without verifying
- Server config changes that re-enable old ciphers accidentally
Quick Checklist
- No export-grade ciphers accepted
- Modern Mozilla cipher list applied
- OpenSSL / TLS library up to date
- TLS 1.2 + 1.3 only
- Re-tested after every server config change
Put your whole site on autopilot — SEO and AI search
PositionMySite monitors every signal on this page across your entire website 24/7 — plus keyword rankings, competitor moves and AI-search readiness (llms.txt, schema, ChatGPT & Gemini visibility). When something breaks, you know before Google does.
Every feature unlocked · No commitment · Cancel anytimeFrequently Asked Questions
A 2015 TLS vulnerability (CVE-2015-0204) that lets attackers downgrade connections to broken export-grade RSA ciphers via a man-in-the-middle attack.
On well-maintained modern servers, no. But unmaintained or legacy systems sometimes still accept export ciphers, and verification is cheap.
Use a modern cipher list. The Mozilla SSL Configuration Generator produces ready-to-paste configs for Apache, Nginx, HAProxy and others that disable all weak suites.
Not directly. It is a security hygiene step that reduces vulnerability to known attacks without any SEO trade-off.
After any server config change, OS patch, or TLS library update. Also include in periodic security audits — annually at minimum.