Forward secrecy means that compromising a server's long-term private key does not allow an attacker to decrypt sessions recorded in the past.
It is achieved by generating an ephemeral key pair per session, so the long-term key authenticates the handshake but never encrypts the session secret itself.
The failure case
Static RSA key exchange has no forward secrecy. The client encrypts the session secret directly to the server's public key.
Anyone who obtains that private key can decrypt every session ever recorded under it. Not future sessions — past ones, retroactively, in bulk.
Why this compounds quantum risk
Harvest now, decrypt later is already about recording traffic for future decryption. Without forward secrecy the attacker's job collapses to a single target: recover one private key, open the entire archive.
With ephemeral key exchange, each session must be attacked separately. That is still a problem against a quantum adversary, but a vastly more expensive one — and it is why a host with no forward secrecy is capped well below one that merely lacks post-quantum protection.
Checking it
Modern TLS 1.3 always provides forward secrecy; static RSA was removed from the protocol entirely.
The risk lives in TLS 1.2 configurations. Servers frequently still accept static-RSA cipher suites when a client offers nothing else, even though a browser would never select one. Offering those suites in isolation is how to find out — and they are accepted on major, otherwise well-configured sites.