Defaults.Exposed › Stats › TLS & certificates
How many HTTPS sites lack HSTS?
October 2026 census edition
As of October 12, 2026, 173,148,160 domains serve HTTPS (Hypertext Transfer Protocol Secure) but send no Strict-Transport-Security header: 78.6% of the 220,264,382 HTTPS-serving domains in the Defaults.Exposed census, which remain downgradable on first contact.
HTTPS without HSTS: how it is measured
It comes from the per-check pass, which runs every graded domain through the full check battery and records a pass, a fail or an undetermined result for each check independently. Every domain in the census is measured directly and counted once.
This isolates sites that did the harder part and skipped the easier one. The first-request window they leave open is the one an attacker on the same network needs. It is the largest cheap win in the transport section.
The figure is an absolute count of domains rather than a sample scaled up. A domain the census could not decide on is left out rather than estimated.
It moves when hosts enable HTTPS, renew or misconfigure certificates, and when platforms change what they negotiate by default. Most of the movement here comes from platform defaults. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see fix your TLS setup.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
HTTPS without HSTS: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "How many HTTPS sites lack HSTS?" (as of October 12, 2026). https://defaults.exposed/stats/how-many-https-sites-lack-hsts
Permalink: https://defaults.exposed/stats/how-many-https-sites-lack-hsts · Machine-readable: /stats/s/https-no-hsts.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.