Free tools
Attempts to connect on port 443 forcing each TLS version (1.0 to 1.3) to find out which ones the server accepts, and flags it as a risk if it still allows obsolete protocols.
TLS 1.0 and 1.1 have known cryptographic weaknesses and are deprecated by major browsers and industry standards (PCI-DSS has banned them for years).
Best practice is to accept only TLS 1.2 and 1.3, explicitly disabling 1.0 and 1.1 in the web server configuration.
Frequently asked questions
It is usually a default server or load-balancer configuration that was never explicitly updated to restrict old versions.
No, only which TLS protocol versions the connection accepts, not the detail of each specific cipher.