HSTS and CSP presence across three editions

Between July and September 2026, the share of answering domains in the census cohort that sent a Strict-Transport-Security header went 19.89%, then 19.11%, then 19.24%. The share that sent any Content-Security-Policy header went 7.64%, 7.93%, 8.02%. Those six numbers are what this page exists to hand you, and they answer your question about as well as three monthly points can. HSTS is flat and CSP is edging up. Neither looks like the hardening curve that header statistics usually get drawn as, and the raw counts behind both rose in each edition anyway.

What gets compared, and what doesn’t

The defaults.exposed census scans the registered internet once a month. Each edition is built from fresh source lists, so the set of domains inside any given TLD changes from one month to the next. A registry feed adds a zone or a source drops one, and the existence pass finds a different number of names alive. That makes “share of all domains” a number you can’t put beside last month’s, because the denominator is a different population each time.

So this series uses a cohort. The cohort is the 1244 TLDs present in the July, August and September lakes, with IDN TLDs excluded because their partition names differ between lakes. Each fact is computed identically per edition from the raw evidence, and disposition and grades play no part. Whether a domain scored well, or was later found dead, makes no difference to these numbers.

Within that cohort, only one kind of line is published here: the share of domains that answered HTTP and sent the header. The denominator is itself an observed set from the same edition, so the composition of the source lists can’t push it around. The other kind of line, presence over all cohort domains, is sensitive to composition for the reason above. It isn’t compared on this page and it isn’t published here. The reasoning behind that choice, and the full list of what the trend pages will and won’t put side by side, is in what we compare.

“Present” means the header was sent in the response the census recorded. It says nothing about what the value was, so nothing about whether a browser would honour it.

HSTS, three editions

Read the two number columns separately. The count of domains sending HSTS went up in each edition. The population answering HTTP also went up in each edition, by more, so the share dropped and then recovered part of the way. If you’d only seen the first column you’d call it growth. If you’d only seen the last you’d call it a slight decline. What happened is that the denominator moved and the header count didn’t keep pace with it.

A count is easy to collect and easy to headline, and it will keep rising for as long as the internet keeps registering domains, whether or not anyone hardens anything, which is why a header trend built on counts alone can’t tell you much. Three points on a cohort with a stated denominator is a smaller claim than a five-year adoption chart, and it’s also one you can check.

CSP, three editions

Here the count and the share agree on direction. More domains sent a CSP header each month, and the share of answering domains that sent one rose too. Three points is a short series and the steps are small, so treat this as edging up rather than a line you’d extend to next year. Of the two headers, though, CSP is the one where a rising count is at least accompanied by a rising share, and that’s the minimum you should demand before using the word “adoption” at all.

Sent is a weaker word than enforcing

A sent header and an enforcing policy are different things, and this series only knows about the first. A Strict-Transport-Security header with a max-age of zero is present. A Content-Security-Policy whose entire value is upgrade-insecure-requests is present, and it constrains no script on the page. The census has a separate research piece on CSP anatomy that opens up what those policies contain directive by directive, and the picture there is a good deal thinner than a presence share suggests. This page doesn’t import those directive counts, because presence is the one measure that stays comparable across editions, and mixing the two would break the method described above.

There’s a second reason presence flatters. Response headers are sent by whatever sits in front of the origin, and for a large slice of the web that’s a CDN or a hosting platform the site owner has never configured. Your domain can send HSTS today because your host decided to, and stop sending it after a platform migration nobody told you about. Presence records what was on the wire on scan day, and it can’t tell you who put it there or whether it’ll still be there next month.

How to read a header statistic from anyone else

When a vendor deck or a conference slide tells you HSTS adoption is up, start by asking whether the denominator is the same population in each period. Then check whether each period was measured the same way, since a scanner change between pulls shows up as a trend. “Adoption” needs pinning down too, because a header that was sent and a header sent with a value that does something are different claims. Last, find out if the number is a count or a share, because a count across a growing internet rises on its own.

Run those questions over the next header chart you’re shown. The shapes you’ll usually meet are a single snapshot with no cohort behind it, or a “top million” list whose membership churns from one pull to the next. This series is built the way it is to survive the same questions: same cohort, same method per edition, share over an observed set, and both numbers shown so you can watch them disagree.

The series also refuses to do the arithmetic for you. This page doesn’t difference, sum, scale or re-percentage anything. If you want a movement, you get the two shares from the sheet and you draw the arrow yourself, because the moment a page starts subtracting September from July it has to defend a comparison the underlying lists may not support.

What a fourth point will change

This is a living page. When the October edition lands, a fourth row goes into each table under the same cohort rule and the same method, and the paragraphs above get rewritten to describe four points instead of three. The method won’t change between editions, since a method that changes with the data is the other common way header trends stop meaning anything.

Four points won’t make a trend either, though it’s enough to tell whether the CSP share keeps rising or plateaus, and whether the HSTS share stays parked around a fifth of answering domains or starts to move. Whichever way it goes, the new row lands in the same table as the three above.

What to do with your own domain

The population figures above describe the web as a whole. Your own domain’s headers are the part of it you can change, and you can see them today.

For HSTS, send Strict-Transport-Security: max-age=31536000; includeSubDomains on each HTTPS response once you’re sure all your subdomains serve HTTPS, and only add preload when you mean it. The HSTS fix page walks through the max-age ramp and what preload commits you to.

For CSP, start with a policy that sets default-src and frame-ancestors and reports violations, then tighten script-src as you learn what your pages load. The headers pillar covers CSP alongside the other response headers the census checks, and the order to add them in so nothing breaks.

Run the free scan on your domain and you’ll see which headers your site sent on the day, with the values, so you can tell whether a present header is doing anything. It takes under a minute and needs no signup.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.