Defaults.Exposed › Stats › Web security headers
How many websites deploy HTTPS, HSTS and CSP together?
October 2026 census edition
As of October 12, 2026, 6,006,555 domains (1.8% of the 332 million graded in the Defaults.Exposed census) deploy the web-security trio of HTTPS (Hypertext Transfer Protocol Secure), HSTS (HTTP Strict Transport Security) and a Content-Security-Policy together.
HTTPS + HSTS + CSP together: how it is measured
It comes from the cross-check pass, which takes the per-domain results and counts the combinations: domains holding one control but not another, and domains holding a whole set together. Every domain in the census is measured directly and counted once.
HTTPS, HSTS and CSP together describe a site whose transport is encrypted, cannot be downgraded, and constrains what its own pages may load.
The figure is an absolute count of domains rather than a sample scaled up. A domain the census could not decide on is left out rather than estimated.
It moves when sites add or drop response headers. These are the cheapest controls the census measures, usually one line of server or CDN (Content Delivery Network) configuration. Adoption stays low because a site without them loads and works exactly as it does with them. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see what the headers do.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
HTTPS + HSTS + CSP together: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "How many websites deploy HTTPS, HSTS and CSP together?" (as of October 12, 2026). https://defaults.exposed/stats/how-many-websites-get-https-hsts-and-csp-right
Permalink: https://defaults.exposed/stats/how-many-websites-get-https-hsts-and-csp-right · Machine-readable: /stats/s/web-secure-trio.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.