Defaults.Exposed › Stats › Web security headers
How many websites deploy HTTPS, HSTS and CSP together?
As of September 5, 2026 · census snapshot 2026-09-05 · page rebuilt 11 September 2026
As of September 5, 2026, 5,430,609 domains: 1.7% of the 317 million graded in the Defaults.Exposed census, deploy the web-security trio of HTTPS, HSTS and a Content-Security-Policy together.
How this number is measured
It comes from the Defaults.Exposed census, a full pass over the public DNS, mail and TLS configuration of every domain we can resolve. There's no sampling and no panel behind it. Each domain is checked directly and counted once, and a check that can't be decided is recorded as undetermined rather than scored as a failure, so the denominator under the figure above is the set of domains where the check had something to read.
It says nothing about one domain in particular. A share of the internet tells you what the default looks like at scale; your own domain either publishes the record or it doesn't, and that takes about a minute to find out. The figure is recomputed from the raw evidence at every edition, so it moves when the internet moves rather than when we re-word the page.
Snapshot 2026-09-05, from the September 2026 edition · the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
Cite this
The figure is current as of September 5, 2026 and is recomputed from the live census at every edition. The number on this page and the number in the machine-readable twin are resolved from the same file at build time, so they can't disagree. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "How many websites deploy HTTPS, HSTS and CSP together?" (as of September 5, 2026). https://defaults.exposed/stats/how-many-websites-get-https-hsts-and-csp-right
Permalink: https://defaults.exposed/stats/how-many-websites-get-https-hsts-and-csp-right · Machine-readable: /stats/s/web-secure-trio.json · Licence: open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.
Related statistics
- What percent of websites have a Content-Security-Policy?
- What percent of websites block clickjacking?
- What percent of websites set X-Content-Type-Options?
- What percent of websites set a Referrer-Policy?
- How many websites pass every security-header check?
- How many websites use cross-origin isolation headers?