Defaults.Exposed › Stats › TLS & certificates
What percent of websites use HSTS?
October 2026 census edition
As of October 12, 2026, only 21.4% of the 220.3 million HTTPS-serving domains in the Defaults.Exposed census send a Strict-Transport-Security header. That is 47,116,222 domains, or 14.2% of all graded domains.
HSTS adoption: how it is measured
It comes from the per-check pass, which runs every graded domain through the full check battery and records a pass, a fail or an undetermined result for each check independently. Every domain in the census is measured directly and counted once.
HSTS (HTTP Strict Transport Security) tells a browser to refuse plain HTTP (Hypertext Transfer Protocol) for a domain in future, closing the first-connection downgrade that a certificate alone cannot. It is one response header with one significant caveat: it applies to the whole domain, so it needs the certificate situation settled first. That caveat is most of the explanation for the adoption gap.
The denominator under that share is 220.3 million: the population where this particular check had something to read. A domain the census could not decide on is recorded as undetermined and left out of it, never counted as a failure.
It moves when hosts enable HTTPS (Hypertext Transfer Protocol Secure), renew or misconfigure certificates, and when platforms change what they negotiate by default. Most of the movement here comes from platform defaults. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see fix your TLS setup.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
HSTS adoption: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "What percent of websites use HSTS?" (as of October 12, 2026). https://defaults.exposed/stats/what-percent-of-websites-use-hsts
Permalink: https://defaults.exposed/stats/what-percent-of-websites-use-hsts · Machine-readable: /stats/s/hsts-adoption.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.