Defaults.Exposed

Defaults.Exposed › Reports

The HTTP-Only Problem: 44 Million Domains Serving Unencrypted Web in 2026

Published

The HTTP-Only Problem: 44 Million Domains Serving Unencrypted Web in 2026

As of August 2026, 44,443,652 domains serve HTTP with no TLS, no redirect to HTTPS, and no HSTS policy. That figure comes from the defaults.exposed August 2026 census: 376,928,750 graded domains, methodology v9, data captured through 16 August 2026. Free TLS certificates have existed for over a decade. Browsers have flagged HTTP as “Not Secure” since 2017. Multiple regulatory frameworks mandate encrypted transport for personal data. None of it has moved 11.8 percent of the measurable internet off plaintext.

This article examines the technical definition of HTTP-only, the profile of the domains that remain there, the upgrade path that most never complete, and the compliance exposure for any business still serving HTTP in 2026.

What “HTTP-Only” Means Technically

An HTTP-only domain, as measured in this census, meets three conditions simultaneously: it responds to an HTTP request on port 80, it does not redirect that request to an HTTPS equivalent, and it presents no valid TLS certificate on port 443. All three must be true. A domain that redirects HTTP to HTTPS and serves TLS on 443 is not counted here, regardless of certificate age or cipher suite quality.

RFC 2818, published in 2000, defined how HTTP operates over TLS. RFC 8446, published in 2018, standardised TLS 1.3, reducing handshake latency to a single round trip and eliminating a class of legacy vulnerabilities present in earlier versions. HTTP Strict Transport Security (HSTS), codified in RFC 6797, allows a server to instruct browsers to refuse future plaintext connections for a specified duration. A domain with a working HSTS policy, even one served over HTTP-then-redirect, signals intentional migration. The 44.4 million domains in this cohort have none of that infrastructure in place.

The practical consequence is that all data exchanged between a browser and an HTTP-only domain travels in plaintext. Request paths, query strings, form submissions, session tokens, and authentication headers are all readable by any network intermediary: the ISP, a corporate proxy, a coffee-shop router, or a state-level deep-packet inspection system. There is no certificate to revoke, no cipher to negotiate, and no forward secrecy. The connection is as transparent as a postcard.

Who Are These 44 Million Domains?

The 44.4 million HTTP-only domains do not form a random sample of the internet. Several patterns emerge from the census data.

Age and registration cohort. A disproportionate share of HTTP-only domains carry registration dates from the 2000s and early 2010s, before browser vendors began enforcing HTTPS and before Let’s Encrypt launched in 2015. These domains were configured for an era in which HTTP was the default and TLS carried a cost, both in money (commercial certificate fees ran $50 to $300 per year) and in configuration complexity. No one updated them because no one needed to, until the incentive structure changed around 2016 to 2018.

Small operators and single-purpose deployments. Many HTTP-only domains are owned by small businesses, sole traders, or individual webmasters who registered a domain for a specific purpose and have not actively maintained it since. A local tradesperson who registered a domain in 2009 for a static brochure site, a community organisation that built a simple HTML page for an annual event, a small manufacturer whose internal tooling was never intended to face the public web: these are representative cases. The operator is still alive; the domain is still registered; but no one is watching it.

Parked and semi-abandoned domains. A meaningful subset of HTTP-only domains serves a parking page from a registrar or reseller. These pages technically respond to HTTP, do not redirect to HTTPS, and carry no TLS. The domain owner may not even be aware the page is live. Registrars have limited commercial incentive to add TLS to parking pages because the pages themselves generate revenue through click advertising and the operator has not requested a hosted site.

ccTLD concentration patterns. The census data shows variation across country-code top-level domains. Some ccTLDs with large volumes of legacy registrations, particularly in markets where broadband and hosting infrastructure matured later, show higher HTTP-only rates than the global 11.8 percent average. This reflects the combination of older registration cohorts, hosting providers that did not upgrade their default stacks, and lower regulatory pressure on web operators compared to jurisdictions with active data protection enforcement.

Domains with no web presence at all. It is worth being explicit about what this cohort is not. The census separately identifies domains that return no HTTP response, no DNS A record, or no reachable server: the zombie and dead cohort. Those domains are graded F on different grounds. The 44.4 million HTTP-only domains are actively responding. They are live, reachable, and serving plaintext content right now.

The HSTS Upgrade Path and Why Many Never Complete It

The intended migration path from HTTP to HTTPS has three steps: obtain a certificate, configure the server to serve TLS on port 443, and add an HTTP-to-HTTPS redirect with an HSTS header. Once HSTS is established with a sufficiently long max-age, the browser will refuse to make plaintext connections to that domain for the duration of the policy, providing a degree of protection even before the connection is established.

Tens of millions of domains have completed at least part of this path. The August 2026 census counts HSTS headers across domains that serve HTTPS, and the presence of this header in the tens of millions indicates meaningful adoption among domains that have already migrated. Let’s Encrypt now dominates the certificate authority landscape for publicly trusted TLS certificates, having removed the cost and most of the configuration friction from the process. Automated renewal via ACME clients means that certificate expiry, once a common reason for broken HTTPS, is largely solved for operators who have configured automation correctly.

The 44.4 million HTTP-only domains represent a cohort that has not started the migration path at all. The bottleneck is not the certificate: Let’s Encrypt issues certificates at no cost. The bottleneck is operator attention. Migrating an existing HTTP site to HTTPS requires access to the hosting control panel or server, the ability to configure a redirect rule, and enough awareness of the issue to know the migration is necessary. For the domains owned by operators who have not logged into their hosting dashboard in three years, none of those conditions are met.

There is also a class of HTTP-only domains where migration is technically possible but operationally blocked. A domain pointed at a legacy CMS with no TLS support in its hosting tier, a domain served from an on-premise Windows IIS instance running a version that predates SNI support, or a domain behind a corporate proxy that strips TLS at the perimeter: these require infrastructure changes, not just configuration. For operators in this position, the cost of migration is real, even if Let’s Encrypt has eliminated the certificate cost.

Regulatory Exposure for Businesses Serving HTTP

For any business that serves personal data over HTTP, the regulatory exposure in 2026 is significant and in some jurisdictions enforceable.

GDPR, Article 32. The General Data Protection Regulation requires controllers and processors to implement “appropriate technical and organisational measures” to ensure a level of security appropriate to the risk, including “encryption of personal data.” Recital 83 identifies unauthorised access to personal data as a risk that appropriate security measures must address. A business that collects name, email, or any other personal data through an HTTP form, without TLS, is transmitting that data in plaintext across the public internet. Supervisory authorities in the EU and UK have issued enforcement notices for exactly this failure mode.

UK Cyber Essentials. The UK government’s Cyber Essentials scheme, backed by the National Cyber Security Centre, requires that all web-based services used to handle organisational data implement HTTPS. Certification under Cyber Essentials or Cyber Essentials Plus requires passing an assessment that includes verification of TLS configuration. Organisations seeking UK government contracts are increasingly required to hold Cyber Essentials certification.

PCI-DSS 4.0. The Payment Card Industry Data Security Standard version 4.0 requires TLS 1.2 as the minimum for all transmissions of cardholder data, with TLS 1.3 becoming a requirement under evolving guidance. Any merchant or service provider that transmits payment data over HTTP, or that relies on HTTP for any part of a payment flow, is out of scope for PCI-DSS compliance by definition and faces card brand penalties.

NIST SP 800-52 Rev 2. For US federal agencies and their contractors, NIST Special Publication 800-52 Revision 2 mandates TLS for all web-based services accessible over public networks. Agencies that have not migrated HTTP-only properties are non-compliant with federal cybersecurity policy, regardless of whether those properties carry sensitive data.

The enforcement gap between regulatory text and actual practice is real: most of the 44.4 million HTTP-only domains will never face a regulatory audit. But the gap closes as soon as a domain is involved in a data breach, a complaint to a supervisory authority, or a contract requirement for certification. At that point, the HTTP configuration becomes a documented failure that predates the incident.

What IT Teams Should Do

The remediation checklist for HTTP-only domains is short. The barrier is operator attention, not technical complexity.

Audit your domain portfolio first. Large organisations accumulate domains over years of acquisitions, product launches, and regional expansions. Run a complete inventory before assuming all domains are covered. Domains registered by a former employee, pointed at a decommissioned product, or managed by a subsidiary may still be live and serving HTTP.

Use automated certificate management. Configure ACME clients (Certbot, Caddy’s built-in TLS, or a cloud provider’s managed TLS offering) for every domain that serves web content. Automated renewal removes the risk of expiry and the operational overhead of manual renewal cycles.

Implement HTTP-to-HTTPS redirects at the server or load-balancer layer. A 301 redirect from port 80 to the HTTPS equivalent costs nothing and eliminates plaintext entry points for users who type a domain without a scheme prefix.

Add HSTS with a long max-age. RFC 6797 recommends a minimum max-age of one year (31,536,000 seconds) for production domains. Submit qualifying domains to the HSTS preload list maintained by browser vendors to ensure protection even on first connection.

For domains with no active web presence, point them to a redirect or return a 301 to your canonical property. A registered domain that serves HTTP on port 80 with no content is not neutral: it is an attack surface for session hijacking and content injection. Decommission or redirect it.

For legacy infrastructure blocking migration, escalate the business case. The cost of a TLS migration, even on complex legacy stacks, is lower than the cost of a GDPR enforcement action, a PCI-DSS non-compliance finding, or a breach notification obligation.

What this means for businesses and security teams

The 11.8% HTTP-only figure in this census is not an abstract statistic — it describes active, publicly reachable domains serving live traffic without any encryption. If your organisation has a domain portfolio that spans subsidiaries, regional sites, legacy products, or historical registrations, the probability that at least one of those domains is serving HTTP is non-trivial. A single HTTP-only domain processing a contact form or login page is enough to trigger GDPR Article 32 exposure in the EU or a PCI-DSS failure finding if the domain touches any payment flow.

The risk of ignoring this is asymmetric. The cost of discovery is near-zero — a free scan takes 30 seconds and returns an unambiguous result. The cost of a data-protection enforcement action, a breach notification exercise, or a failed Cyber Essentials audit is categorically larger. For any organisation that has not systematically audited its domain portfolio for HTTP-only properties in the last 12 months, that audit should be prioritised above almost every other security configuration task, because it costs nothing and the downside of inaction is documented and enforceable.

For small businesses and sole traders who may recognise themselves in the “small operator, static brochure site” description: the HTTPS migration is free. Let’s Encrypt has removed the certificate cost entirely, and most hosting control panels in 2026 have a one-click HTTPS enable button. The only thing standing between an HTTP-only site and a compliant one is the 15 minutes it takes to log in and click it. The risk of not doing so — “Not Secure” warnings driving visitors away, regulatory exposure if any personal data crosses that connection, and the site being usable as an injection point against your own visitors — is real and present, not theoretical.

Data to cite

FAQ: HTTP-Only Domains in 2026

How many websites are still on HTTP in 2026? The defaults.exposed August 2026 census found 44,443,652 domains actively serving HTTP with no TLS, no redirect to HTTPS, and no HSTS policy — representing 11.8% of 376,928,750 graded domains. These are live, actively responding domains, not dead registrations or parked pages counted on different grounds.

Is serving HTTP still a security risk in 2026? Yes. Every request to an HTTP-only domain travels in plaintext — form submissions, session tokens, authentication headers, and all content are readable by any network intermediary including ISPs, corporate proxies, and public Wi-Fi operators. No certificate means no encryption, no forward secrecy, and no mechanism to detect tampering.

Does GDPR require HTTPS? GDPR Article 32 requires “appropriate technical measures” including encryption of personal data. A business collecting personal data — names, email addresses, any form submission — over HTTP without TLS is transmitting that data in plaintext, which supervisory authorities in the EU and UK have treated as a failure of Article 32. This is regulatory context, not legal advice.

Is HTTPS free to implement? Yes for the certificate: Let’s Encrypt issues publicly trusted TLS certificates at no cost with automated renewal. Most hosting control panels in 2026 include one-click HTTPS enablement. The remaining cost is operator time — for a simple site, typically under an hour. For legacy infrastructure (old CMS, on-premise IIS, corporate proxy stripping TLS), the engineering cost is real but still lower than the cost of a compliance failure.

What should I do if my domain is HTTP-only? First, verify the situation with a free scan. Then: enable TLS via your hosting provider or Let’s Encrypt, configure an HTTP-to-HTTPS redirect at port 80, and add an HSTS header with a max-age of at least one year. For domains with no active web presence, configure them to redirect to your canonical HTTPS property or decommission them — an HTTP-responding domain with no content is an attack surface, not a neutral state.

What should I do about HTTP-only domains in my organisation’s portfolio? Run a complete domain inventory before assuming coverage. Domains registered during acquisitions, product launches, or regional expansions by former employees or subsidiaries may still be live and serving HTTP. Prioritise audit of any domain that could receive form submissions or session data, then work through the remainder. The audit itself costs nothing; finding a compliance gap costs far more after a regulator or auditor finds it first.

How does the August 2026 HTTP-only count compare to the July 2026 census? August 2026 is the immediately prior census round after July 2026. The 44,443,652 HTTP-only figure from August reflects the measured state at 16 August 2026. Year-on-year the trend has been slow improvement as hosting platforms automate TLS provisioning, but the speed of that improvement — measured in millions of domains per year against a base of 44+ million — makes this a years-long transition rather than an imminent solved problem.

Check your domain free at defaults.exposed — see immediately whether your domain is HTTP-only, redirects correctly to HTTPS, and carries a valid HSTS policy. Takes 30 seconds. No account needed. Read the full State of Domain Security 2026 report.

How to cite this report

Press / blog: defaults.exposed (2026). The HTTP-Only Problem: 44 Million Domains Serving Unencrypted Web in 2026. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/http-only-44-million-domains-2026

Academic: defaults.exposed. (2026, August 18). The HTTP-Only Problem: 44 Million Domains Serving Unencrypted Web in 2026. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/http-only-44-million-domains-2026

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=376,928,750 graded domains)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026

Aggregate data only. Data stored and processed in the EU.

Data source: defaults.exposed August 2026 census, methodology v9, as of 2026-08-16. 376,928,750 domains graded from approximately 432 million scanned. HTTP-only count: 44,443,652 (11.8%). References: RFC 2818 (HTTP over TLS), RFC 6797 (HSTS), RFC 8446 (TLS 1.3), GDPR Article 32 and Recital 83, UK Cyber Essentials (NCSC), PCI-DSS v4.0, NIST SP 800-52 Rev 2.