Defaults.Exposed › Stats › Web security headers
How many websites deploy HTTPS, HSTS and CSP together?
As of July 28, 2026 · census snapshot 2026-07-28
As of July 28, 2026, 4,512,670 domains — 1.6% of the 276 million graded in the Defaults.Exposed census — deploy the web-security trio of HTTPS, HSTS and a Content-Security-Policy together.
Cite this
Statistic current as of July 28, 2026. Recomputed from the live census each edition; the number on this page and the machine-readable twin always match. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "How many websites deploy HTTPS, HSTS and CSP together?" (as of July 28, 2026). https://defaults.exposed/stats/how-many-websites-get-https-hsts-and-csp-right
Permalink:https://defaults.exposed/stats/how-many-websites-get-https-hsts-and-csp-right · Machine-readable:web-secure-trio.json · Licence:open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.
Related statistics
- What percent of websites have a Content-Security-Policy?
- What percent of websites block clickjacking?
- What percent of websites set X-Content-Type-Options?
- What percent of websites set a Referrer-Policy?
- How many websites pass every security-header check?
- How many websites use cross-origin isolation headers?