HSTS and CSP presence across four editions

Between July and October 2026, the share of answering domains in the census cohort that sent a Strict-Transport-Security header went 19.89%, then 19.11%, 19.24% and 19.57%. The share that sent any Content-Security-Policy header went 7.64%, 7.93%, 8.02% and 8.40%. By the one-point rule this site applies to trends, both are flat. CSP’s share rose in every edition, by less than one point in all. Neither looks like the hardening curve that header statistics usually get drawn as, and the raw counts behind both rose in each edition anyway.

What gets compared, and what doesn’t

The defaults.exposed census scans the registered internet once a month. Each edition is built from fresh source lists, so the set of domains inside any given TLD (Top-Level Domain) changes from one month to the next. A registry feed adds a zone or a source drops one, and a different number of the names turn out to exist. Up to September, a pass before the scan removed the names that don’t exist. From October, names that answer NXDOMAIN (Non-Existent Domain) are removed after the scan. That makes “share of all domains” a number you can’t put beside last month’s, because the denominator is a different population each time.

So this series uses a cohort. The cohort is the 1243 TLDs present in the July, August, September and October lakes, with IDN (Internationalized Domain Name) TLDs excluded because their partition names differ between lakes. Each fact is computed identically per edition from the raw evidence, and disposition and grades play no part. Whether a domain scored well, or was later found dead, makes no difference to these numbers.

Within that cohort, only one kind of line is published here: the share of domains that answered HTTP (Hypertext Transfer Protocol) and sent the header. The denominator is itself an observed set from the same edition, so the composition of the source lists can’t push it around. A name that doesn’t exist never answers HTTP, so it stays out of that denominator whichever way it was removed. The other kind of line, presence over all cohort domains, is sensitive to composition for the reason above. It isn’t compared on this page and it isn’t published here. The reasoning behind that choice, and the full list of what the trend pages will and won’t put side by side, is in what we compare.

“Present” means the header was sent in the response the census recorded. It says nothing about what the value was, so nothing about whether a browser would honour it.

HSTS, four editions

Read the two number columns separately. The count of domains sending HSTS (HTTP Strict Transport Security) went up in each edition. The population answering HTTP also went up in each edition, and by more across the four editions taken together. So the share dropped in August and has recovered part of the way since. October’s 19.57% is still below July’s 19.89%. If you’d only seen the first column you’d call it growth. If you’d only seen the last you’d call it a slight decline from July. What happened is that the denominator moved and the header count didn’t keep pace with it.

The latest count in this table differs from the 47,116,222 on the HSTS page. That page counts domains in every TLD of the edition that answered over HTTPS (Hypertext Transfer Protocol Secure). This cohort is a different set of TLDs, the 1,243 present in all four lakes, and its denominator is every domain that answered HTTP.

A count is easy to collect and easy to headline. It will keep rising for as long as the internet keeps registering domains, whether or not anyone hardens anything, which is why a header trend built on counts alone can’t tell you much. The four points here sit on a cohort with a stated denominator, so each one can be checked.

CSP, four editions

Here the count and the share agree on direction. More domains sent a CSP header each month, and the share of answering domains that sent one rose too. Four points is a short series and the steps are small. Taken together they still come to less than the one full percentage point the site’s trend rule needs, so the accurate description is flat, and the line is too short to extend to next year. Of the two headers, though, CSP is the one where a rising count is at least accompanied by a rising share. That’s the minimum you should demand before using the word “adoption” at all.

Sent is a weaker word than enforcing

A sent header and an enforcing policy are different things, and this series only knows about the first. A Strict-Transport-Security header with a max-age of zero is present. A Content-Security-Policy whose entire value is upgrade-insecure-requests is present, and it constrains no script on the page. The census has a separate research piece on CSP anatomy that opens up what those policies contain directive by directive, and the picture there is a good deal thinner than a presence share suggests. This page doesn’t import those directive counts, because presence is the one measure that stays comparable across editions, and mixing the two would break the method described above.

There’s a second reason presence flatters. Response headers are sent by whatever sits in front of the origin, and for a large slice of the web that’s a CDN (Content Delivery Network) or a hosting platform the site owner has never configured. Your domain can send HSTS today because your host decided to, and stop sending it after a platform migration nobody told you about. Presence records what was on the wire on scan day, and it can’t tell you who put it there or whether it’ll still be there next month.

How to read a header statistic from anyone else

When a vendor deck or a conference slide tells you HSTS adoption is up, start by asking whether the denominator is the same population in each period. Then check whether each period was measured the same way, since a scanner change between pulls shows up as a trend. “Adoption” needs pinning down too, because a header that was sent and a header sent with a value that does something are different claims. Last, find out if the number is a count or a share, because a count across a growing internet rises on its own.

Run those questions over the next header chart you’re shown. The shapes you’ll usually meet are a single snapshot with no cohort behind it, or a “top million” list whose membership churns from one pull to the next. This series answers them with the same cohort, same method per edition, share over an observed set, and both numbers shown so you can watch them disagree.

The series also refuses to do the arithmetic for you. This page doesn’t difference, sum, scale or re-percentage anything. If you want a movement, you get the two shares from the sheet and you draw the arrow yourself. The moment a page starts subtracting one edition from another, it has to defend a comparison the underlying lists may not support.

What the fourth point changed

The October edition put a fourth row into each table, under the same cohort rule and the same method, and the paragraphs above now describe four points. The cohort is the TLDs present in every lake so far, so it’s drawn again each time an edition is added. The values in the tables above all come from the four-edition cohort.

Four points still don’t make a trend. They do answer the two questions the third point left open. The CSP share rose again, its third rise in a row, and it’s still less than a point above July. The HSTS share stayed around a fifth of answering domains and rose for the second edition running, still below where it started in July.

What to do with your own domain

The population figures above describe the web as a whole. Your own domain’s headers are the part of it you can change, and you can see them today.

For HSTS, send Strict-Transport-Security: max-age=31536000; includeSubDomains on each HTTPS response once you’re sure all your subdomains serve HTTPS, and only add preload when you mean it. The HSTS fix page walks through the max-age ramp and what preload commits you to.

For CSP, start with a policy that sets default-src and frame-ancestors and reports violations, then tighten script-src as you learn what your pages load. The headers pillar covers CSP alongside the other response headers the census checks, and the order to add them in so nothing breaks.

Run the free scan on your domain and you’ll see which headers your site sent on the day, with the values, so you can tell whether a present header is doing anything. It takes under a minute and needs no signup.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.