Defaults.Exposed › Stats › TLS & certificates
How many HTTPS sites lack HSTS?
As of July 28, 2026 · census snapshot 2026-07-28
As of July 28, 2026, 170,206,896 domains serve HTTPS but send no Strict-Transport-Security header — 80.9% of all HTTPS-serving domains in the Defaults.Exposed census remain downgradable on first contact.
Cite this
Statistic current as of July 28, 2026. Recomputed from the live census each edition; the number on this page and the machine-readable twin always match. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "How many HTTPS sites lack HSTS?" (as of July 28, 2026). https://defaults.exposed/stats/how-many-https-sites-lack-hsts
Permalink:https://defaults.exposed/stats/how-many-https-sites-lack-hsts · Machine-readable:https-no-hsts.json · Licence:open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.