Defaults.Exposed › October 2026 census › v10 registry › HSTS
HSTS
Methodology v10 · canonical ID hsts-header · Web Security · scored
Forces the secure padlock every visit so customers can't be downgraded to an insecure connection.
HSTS: definition
| Canonical ID | hsts-header |
|---|---|
| Category | Web Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The site sends a Strict-Transport-Security header with a meaningful max-age. |
| Fail | No HSTS (HTTP Strict Transport Security) header is sent over HTTPS (Hypertext Transfer Protocol Secure). |
| Example (passing) | Strict-Transport-Security: max-age=31536000; includeSubDomains |
HSTS across the census
21.4% of HTTPS-serving domains send an HSTS header (47,116,222 of 220,264,382, as of October 12, 2026).
Aggregates only: never an individual domain's result.
How this check is scored
HSTS is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 112,227,937 of the 332,492,319 graded domains had no determinable result for this check: the header only has meaning over HTTPS, so the check runs on HTTPS-serving domains.
Every outcome in the census
| Outcome | Domains | Share of HTTPS-serving domains | In the headline figure |
|---|---|---|---|
| Sends Strict-Transport-Security | 47,116,222 | 21.4% | Yes |
| No HSTS header | 173,148,160 | 78.6% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of HTTPS-serving domains that send an HSTS header by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 147,859,634 domains | 21.9% | .cam 56.8%, .lol 53.4%, .asia 43.6% | .xyz 3.76%, .cfd 5.36%, .wiki 6.20% |
| Country-code TLDs (ccTLDs): 167 TLDs, 72,019,660 domains | 20.2% | .cn 37.0%, .ai 36.8%, .io 30.8% | .pl 9.43%, .xn--p1ai 9.56%, .hu 11.0% |
The largest TLD in this base, .com, stands at 23.9% (24,288,207 of 101,602,779).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 219,879,294 of the 220,264,382 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 6 Web Security checks with a published figure, HSTS has the 2nd highest pass share. Next above it is HTTP (Hypertext Transfer Protocol)→HTTPS redirect: 51.3% of domains whose HTTP redirect behaviour could be observed. Next below it is MIME-sniffing protection: 18.7% of domains whose page returned a 2xx response. Across every check with a published figure it ranks 15th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix HSTS
Cite this check
Defaults.Exposed, "HSTS (hsts-header)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/hsts-header
Permalink: https://defaults.exposed/methodology/hsts-header ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data