Defaults.Exposed › Stats › TLS & certificates
TLS & certificates
6 statistics · figures as of November 2, 2026 · census snapshot 2026-11-02 · November 2026 edition
HTTPS (Hypertext Transfer Protocol Secure), certificate health, TLS (Transport Layer Security) versions and who issues the certificates the web runs on.
| Measure | As of November 2, 2026 |
|---|---|
| HTTPS adoption | 66.4% |
| TLS 1.3 adoption | 94.9% |
| Valid certificate share | 89.4% |
| HSTS adoption | 22.0% |
Transport security is the area where the census records the broadest adoption. 66.4% of graded domains serve their site over HTTPS, and of the domains presenting a certificate, 89.4% present one that is valid and trusted. Version adoption has followed: 94.9% of HTTPS-serving domains negotiate TLS 1.3, with 5.1% topping out at TLS 1.2.
It got that way through defaults and free issuance. Let’s Encrypt now issues for 57.37% of certificate-presenting domains, which makes it the largest authority by a wide margin; the next, Google Trust Services, issues for 17.41%. When the cost of a certificate went to zero and hosting platforms started provisioning them automatically, adoption followed. The same holds for other controls: they get adopted when they become the default.
The residue is instructive. 112,627,313 domains have no working HTTPS at all, a group that also takes in domains with no website, and 4,318,393 present a self-signed certificate, which produces a browser warning and trains users to click through it. Neither is a hard problem in 2026. They persist on hosts nobody has touched in years, and those hosts are the ones most likely to be running other unmaintained software as well.
The gap that undercuts the rest is HSTS (HTTP Strict Transport Security). Only 22.0% of HTTPS-serving domains send a Strict-Transport-Security header, leaving 173,407,389 domains that serve HTTPS perfectly well and remain downgradable on a visitor’s first connection. Having a certificate protects the connection you make securely; HSTS is what stops an attacker talking a browser out of making it that way in the first place.
What remains after the HTTPS battle was won is the unglamorous part. Certificates expire, and an expired certificate produces the same browser interstitial as an attack would. Hostname mismatches do the same. Protocol and cipher configuration drifts out of date on hosts nobody revisits, and shortening certificate lifetimes across the industry means any host still renewing by hand now fails more often. Almost all of it is solved by automation that already exists and costs nothing.
Nobody persuaded millions of site owners that transport security mattered. Certificates became free, issuance became automatic, hosting platforms turned it on by default, and browsers started marking the alternative as insecure.
HSTS is one response header on a site that already has a certificate. The scan checks yours along with the certificate behind it.
Every statistic in TLS & certificates
Each has its own citable permalink and a machine-readable twin at
/stats/s/<id>.json, resolved from the same census files as the figures above.