diff --git a/classes.py b/classes.py
index 866d8c4..6654d0e 100644
--- a/classes.py
+++ b/classes.py
@@ -112,6 +112,9 @@ class User(TSObject):
         # Stores service bot name if applicable
         self.service = None
 
+        # Whether the user is using SSL/TLS (None = unknown)
+        self.ssl = None
+
     @property
     def nick(self):
         return self._nick
diff --git a/protocols/hybrid.py b/protocols/hybrid.py
index 0a87059..3f41072 100644
--- a/protocols/hybrid.py
+++ b/protocols/hybrid.py
@@ -211,6 +211,9 @@ class HybridProtocol(TS6Protocol):
         # Call the OPERED UP hook if +o is being added to the mode list.
         self._check_oper_status_change(uid, parsedmodes)
 
+        # Track SSL/TLS status
+        self.users[uid].ssl = ('+S', None) in parsedmodes
+
         # Set the account name if present
         if account:
             self.call_hooks([uid, 'CLIENT_SERVICES_LOGIN', {'text': account}])
diff --git a/protocols/p10.py b/protocols/p10.py
index d920eca..30a0f9e 100644
--- a/protocols/p10.py
+++ b/protocols/p10.py
@@ -935,6 +935,7 @@ class P10Protocol(IRCS2SProtocol):
                       ident, host, realname, realhost, ip)
 
             uobj = self.users[uid] = User(self, nick, ts, uid, source, ident, host, realname, realhost, ip)
+            uobj.ssl = False
             self.servers[source].users.add(uid)
 
             # https://github.com/evilnet/nefarious2/blob/master/doc/p10.txt#L708
@@ -952,6 +953,9 @@ class P10Protocol(IRCS2SProtocol):
                         accountname = modepair[1].split(':', 1)[0]
                         self.call_hooks([uid, 'CLIENT_SERVICES_LOGIN', {'text': accountname}])
 
+                    elif modepair[0][-1] == self.umodes.get('ssl'):  # track SSL status where available
+                        uobj.ssl = True
+
                 # Call the OPERED UP hook if +o is being added to the mode list.
                 self._check_oper_status_change(uid, parsedmodes)
 
diff --git a/protocols/ts6.py b/protocols/ts6.py
index 57dcd83..63b91e5 100644
--- a/protocols/ts6.py
+++ b/protocols/ts6.py
@@ -605,6 +605,10 @@ class TS6Protocol(TS6BaseProtocol):
         if accountname != "*":
             self.call_hooks([uid, 'CLIENT_SERVICES_LOGIN', {'text': accountname}])
 
+        # charybdis and derivatives have a usermode (+Z) to mark SSL connections
+        # ratbox doesn't appear to have this
+        self.users[uid].ssl = ('+%s' % self.umodes.get('ssl'), None) in parsedmodes
+
         return {'uid': uid, 'ts': ts, 'nick': nick, 'realhost': realhost, 'host': host, 'ident': ident, 'ip': ip}
 
     def handle_uid(self, numeric, command, args):
diff --git a/protocols/unreal.py b/protocols/unreal.py
index db17c06..2ac238d 100644
--- a/protocols/unreal.py
+++ b/protocols/unreal.py
@@ -507,6 +507,9 @@ class UnrealProtocol(TS6BaseProtocol):
         if ('+r', None) in parsedmodes and accountname.isdigit():
             accountname = nick
 
+        # Track SSL/TLS status
+        self.users[uid].ssl = ('+z', None) in parsedmodes
+
         if not accountname.isdigit():
             self.call_hooks([uid, 'CLIENT_SERVICES_LOGIN', {'text': accountname}])