Defaults.Exposed › Reports

TLS 1.3 by Country: Which TLDs Win on Defaults (2026)

Published 2026-08-18

Figures as of 16 August 2026 · methodology v9. This is a recurring report; each edition re-measures the same population so the numbers can be tracked over time. All figures are aggregate — we never publish an individual business’s grade or name an individual registrant’s domain.

The headline: encryption quality now maps to when a country’s hosting was built, not how rich it is

Of the 231,455,163 domains that completed a TLS handshake, 94.9% negotiated TLS 1.3 with our scanner — and the league table turns the usual geography of technology upside down. Vanuatu’s .vu tops our measured TLDs at 99.6%. Nigeria’s .ng (98.7%), Kenya’s .ke (98.5%) and Bangladesh’s .bd (98.4%) all beat .com (95.0%) and Germany’s .de (94.8%). At the bottom sit South Korea’s .kr at 73.3% and — awkwardly — the US government’s own .gov at 77.0%.

The pattern is not wealth. It is infrastructure age. Where a country’s hosting stack was built recently, TLS 1.3 came in the box. Where a domain has been sitting on the same server since 2015, someone has to touch it — and mostly, nobody has.

Key numbers

• 94.9% of 231,455,163 TLS-completing domains negotiated TLS 1.3 (219,593,564) in the August 2026 census.
• 11,861,583 domains (5.1%) topped out at TLS 1.2 — the last version before 1.3 shipped in 2018.
• Zero domains negotiated TLS 1.0 or 1.1 with a modern client, across the entire measured web.
• Vanuatu’s .vu leads the measured TLDs at 99.6% TLS 1.3; Nigeria’s .ng (98.7%) and Kenya’s .ke (98.5%) outrank every large Western TLD.
• South Korea’s .kr is the weakest major ccTLD at 73.3% TLS 1.3 — 362,513 HTTPS domains, more than a quarter stuck on 1.2.
• US .gov manages 77.0% TLS 1.3 — below every large commercial TLD we measured.

What we measured, in one paragraph

For every domain in the August 2026 census that completed a TLS handshake — 231,455,163 of them — we recorded the protocol version the server actually negotiated with a modern client. That is the whole metric. It is deliberately simple: negotiated version is what a real visitor with a current browser gets, and it is the one TLS number a non-specialist can act on. Our published TLS 1.3 adoption report covers the global trend line, and weak and outdated TLS covers cipher-level failures; this edition is the geographic cut — the same handshake data, sliced by TLD.

One honest limitation up front, because the rest of the article leans on it: negotiated version is not offered version. A server that still accepts TLS 1.0 from an ancient client, but negotiates 1.3 with ours, shows up here as a 1.3 domain. The legacy long tail is real; it is just invisible at this vantage. More in “How we measured this” below.

Which countries lead TLS 1.3 adoption?

Here is the part that surprises people. Sort the world’s TLDs by TLS 1.3 share and the top of the table is not Silicon Valley’s neighbourhood.

Nigeria beats Germany. Tanzania beats .com. Iran, under sanctions, beats the global baseline. This is not because Lagos webmasters care more about handshakes than Frankfurt ones. It is a cohort effect: domains in fast-growing internet economies overwhelmingly live on hosting platforms and CDNs built after 2018, when TLS 1.3 was already the shipping default. A .ng site never had a legacy config to migrate away from. A .de site registered in 2009 very possibly did, and a config nobody touches is a config that never improves.

The two tech-branded ccTLDs make the same point from the other direction. .ai and .dev score 98%+ not because their owners tuned anything but because startups deploy on modern platforms by default. The best security decision most of these domains ever made was being born late.

Which TLDs are still stuck on TLS 1.2?

The bottom of the table is where it gets interesting, because the laggards are not poor and not obscure.

South Korea is the finding that deserves a double-take. This is one of the most connected countries on earth, with world-class consumer broadband, and its national TLD has the weakest negotiated-TLS profile of any major ccTLD we measured: 96,655 Korean HTTPS domains cap out at a protocol from 2008. Japan (84.9%) and Taiwan (86.8%) show a milder version of the same shape. East Asia’s early-adopter economies built vast domestic hosting estates in the 2000s and 2010s — and that installed base now ages in place. The head start became the anchor.

.gov is the other eyebrow-raiser. The TLD that exists purely for the US government negotiates TLS 1.3 on 77.0% of its HTTPS domains — a lower rate than .com, .us, .uk, and for that matter .ng and .ke. As industry context rather than census data: US federal policy has required TLS 1.2 as a floor for years and encourages 1.3, and 1.2 remains a compliant, secure choice when configured well. But the gap between the government TLD and the commercial web it regulates is a measurement, not an opinion. Nearly one in four .gov HTTPS domains hasn’t picked up a protocol that has been final since 2018.

Russia’s numbers (79.8% on .ru, with 563,678 domains on 1.2 — the largest single national block of legacy negotiation we measured among ccTLDs) read like the sanctions era in protocol form: a hosting market cut off from the global CDN ecosystem upgrades on its own clock.

What happened to the TLS 1.0 and 1.1 holdouts?

We went looking for them. At this vantage, they do not exist.

Across all 231,455,163 TLS-completing domains, the number that negotiated TLS 1.0 with our modern client is zero. TLS 1.1: also zero. Not “rounds to zero” — zero recorded negotiations, in every TLD, in the whole census round.

Read that carefully, because it is two findings wearing one number. The first is genuinely good news: a visitor with a current browser essentially cannot end up on a 1990s-era TLS session anywhere on the measured web. The ecosystem work that deprecated 1.0/1.1 — labelled as industry context: both were formally deprecated by RFC 8996 in March 2021, and the major browsers dropped them in 2020 — actually landed. When client and server both speak anything modern, the modern version wins, every time.

The second finding is about what this measurement cannot see, and it is the caveat this article is obliged to carry. Version negotiation picks the best protocol both sides support. Our client supports current protocols, so any server that also does will never reveal whether it would still accept a 1.0 handshake from an old client. Servers offering legacy TLS are therefore not enumerable from negotiated-version data — a scan that deliberately offered only 1.0 would find a nonzero holdout population, and that is a different (and noisier) experiment than this one. What we can say precisely: the legacy holdouts, whatever their number, are unreachable by any current mainstream browser and invisible at negotiation. The live battleground in 2026 is not 1.0 versus 1.3. It is 1.2 versus 1.3 — and that is a battle about defaults, not danger.

Which matters for how you read the tables above. A domain on TLS 1.2 is not broken; 1.2 with strong ciphers remains acceptable in every mainstream guideline (industry context again). What the 1.2 share measures is staleness — the fraction of a TLD’s infrastructure that nobody has touched since before 2018. That is why it tracks so cleanly with infrastructure age, and why we treat it as a leading indicator: estates that don’t pick up free protocol upgrades tend not to pick up anything else either.

Why do defaults decide this?

Because almost nobody chooses a TLS version. It arrives with the stack.

Enable TLS 1.3 by hand and you edit one line in a server config. Almost no one does this at web scale. What actually moves the number is platform churn: a host upgrades its load balancers, a site moves behind a CDN, a distro ships a new OpenSSL, and a million domains silently improve overnight. The owner never knows. The reverse also holds: a self-managed box that has been quietly serving the same site since 2016 keeps its 2016 handshake until the hardware dies.

That is why this map is worth publishing at all. Per-TLD TLS 1.3 share is a proxy for how much of a country’s web runs on infrastructure someone still maintains. Vanuatu at 99.6% means essentially all of .vu’s small web estate lives on modern managed platforms. Korea at 73.3% means a quarter of a large, sophisticated web estate is running on configurations old enough that a free upgrade from 2018 has still not reached them. Neither number is about effort. Both are about defaults — which is the recurring finding of this whole census: most of what separates an A-grade domain from an F-grade one is not spending, it is whether anyone ever looked.

How we measured this

• Denominator: 231,455,163 domains that completed a TLS handshake with a negotiated protocol on record in the August 2026 census round, out of 376.9 million graded domains. Domains with no working HTTPS are excluded from every percentage in this article — a TLD’s TLS 1.3 share says nothing about how much of that TLD serves HTTPS at all.
• Metric: the protocol version negotiated with our scanner’s modern TLS client, deduplicated per domain. One version per domain.
• The mandatory caveat: this is a negotiated-version distribution only. Servers that still offer TLS 1.0/1.1 to legacy clients but negotiate higher with ours are counted at the higher version; legacy-offering servers are not enumerable from this data. The measured 1.0/1.1 counts (zero) describe what a modern client experiences, not what old servers would tolerate.
• TLD ≈ country is a proxy, not a fact. ccTLD registrants are mostly but not exclusively in-country, and plenty of national web presence lives on .com. Read the per-TLD numbers as properties of each TLD’s hosting estate, not as national statistics.
• Vantage: scanned from our EU measurement infrastructure. A client negotiating from a different region could in principle be routed to different infrastructure by multi-region operators; we make no claims about region-dependent negotiation.
• Small TLDs: we quote no TLD below ~10,000 HTTPS-serving domains in the league tables; percentages on tiny populations are noise.
• Industry-context labels: RFC and deprecation dates (TLS 1.3 = RFC 8446, 2018; RFC 8996, 2021; browser removals, 2020) and compliance-guideline statements are public industry knowledge, not census measurements.
• Aggregate only. We publish TLD-level counts and shares. We never name, grade, or publish data about an individual registrant’s domain.
• Data is stored and processed within the EU.

What this means for IT and security teams

If your organisation operates domains across multiple country-code TLDs — through subsidiaries, regional presences, or acquired properties — TLS version is not a safe assumption. This data shows that an organisation’s European subsidiary on .de could have a meaningfully different TLS profile than its .ng or .au properties, purely because of when those domains were last touched. A security posture review that checks the headquarter domain but ignores regional ccTLD properties is leaving a blind spot that census data makes visible at scale.

For government and regulated-sector organisations, the .gov finding is particularly pointed: 77.0% TLS 1.3 on a TLD that exists exclusively for US federal use, sitting below commercial TLDs including .com, .uk, and several African ccTLDs. If your agency’s HTTPS properties haven’t been reviewed since before 2018, there is a meaningful chance you are on the wrong side of that 23%. The fix is not a procurement: it is a server configuration review and, in most cases, a single line change or a CDN that does it automatically.

For anyone running self-managed infrastructure — bare metal, VMs, on-premise hosting — the lesson from this map is that time is the enemy. A domain on the right protocol in 2018 is still on the right protocol today only if someone maintained the stack underneath it. South Korea’s 96,655 domains stuck on TLS 1.2 are not there because Korean engineers are less capable; they are there because infrastructure ages silently and the only way to know where you stand is to check.

Data to cite

• “Of the 231,455,163 domains that completed a TLS handshake in the August 2026 census, 94.9% negotiated TLS 1.3 — but 11,861,583 domains (5.1%) remain on the older TLS 1.2 protocol.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “South Korea’s .kr TLD shows just 73.3% TLS 1.3 adoption among its 362,513 HTTPS domains, making it the weakest major country-code TLD measured — despite South Korea being one of the world’s most connected nations.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “The US government’s .gov TLD achieves only 77.0% TLS 1.3 adoption, a lower rate than every large commercial TLD measured including .com, .uk, Nigeria’s .ng, and Kenya’s .ke.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “Nigeria’s .ng (98.7%), Kenya’s .ke (98.5%), and Bangladesh’s .bd (98.4%) all achieve higher TLS 1.3 adoption than Germany’s .de (94.8%) and the global .com (95.0%) — because recently built hosting estates started with TLS 1.3 as the default.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “Russia’s .ru TLD has 563,678 domains still negotiating TLS 1.2 — the largest single national block of legacy TLS negotiation measured among country-code TLDs in August 2026.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “Across all 231,455,163 TLS-completing domains in the August 2026 census, zero domains negotiated TLS 1.0 or 1.1 with a modern client — the deprecation of those protocols by browsers in 2020 and by RFC 8996 in 2021 has fully taken hold.” — defaults.exposed August 2026 Domain Security Census (432M domains)

FAQ

Is TLS 1.2 still safe in 2026? Yes, when configured with modern ciphers — that statement is industry consensus, not census data. What our data adds: 11,861,583 domains (5.1% of the TLS-completing web) negotiate at most 1.2 as of 16 August 2026, and that share is better read as an infrastructure-age signal than a vulnerability count. The cipher-level failures that actually break security are a different, smaller cohort, covered in weak and outdated TLS.

Which country has the best TLS 1.3 adoption? Among TLDs with a meaningful population, Vanuatu’s .vu leads our measurement at 99.6% of 30,425 HTTPS domains, with Nigeria’s .ng (98.7%) and Kenya’s .ke (98.5%) close behind — all ahead of .com at 95.0%. The common thread is recently built hosting estates where TLS 1.3 was the default from day one.

Why is South Korea’s TLS adoption so low? Our census measures the what, not the why: 73.3% of .kr’s 362,513 HTTPS domains negotiate TLS 1.3, the lowest major-ccTLD figure we recorded, with 96,655 domains on 1.2. The pattern across .kr, .jp (84.9%) and .tw (86.8%) is consistent with large, early-built domestic hosting estates aging in place — an interpretation, and labelled as one.

Does anyone still use TLS 1.0 or 1.1? No modern visitor does. Across all 231.5 million TLS-completing domains in the August 2026 round, zero negotiated 1.0 or 1.1 with our current-protocol client. Servers quietly still offering those versions to ancient clients can exist but are invisible to negotiated-version measurement — that is the method’s stated blind spot.

How do I check and fix my own domain’s TLS version? Negotiating TLS 1.3 is a server-software property, not a purchase: current versions of every mainstream web server and every major CDN enable it by default, so the fix is usually “update, or front the site with a modern proxy” at zero licence cost. You can see what your domain negotiates, along with 33 other externally observable checks, in our free scan.

What should I do if my domain is still on TLS 1.2? First, check whether you are on managed hosting or self-managed infrastructure. On managed hosting (a CDN, cloud platform, or shared host), a support ticket or a settings change is usually all that is needed. On self-managed servers, update your web server software and OpenSSL to current releases — TLS 1.3 is enabled by default in every major server package from 2019 onwards. The upgrade itself costs nothing; the barrier is knowing which of your domains are affected, which is exactly what a census-based scan tells you.

How does TLS 1.3 adoption compare to the July 2026 census? This is the August 2026 round, and the July 2026 census is the prior measurement. The August round scanned 432 million domains and graded 376.9 million, with 231,455,163 completing a TLS handshake. Direct comparison to July figures would require the prior round’s TLD-level breakdown; what we can say is that the global 94.9% TLS 1.3 share reflects steady platform-driven improvement — the kind that happens without individual operators acting.

Why does this TLS map matter for procurement and vendor selection? If your organisation is evaluating hosting providers or cloud regions, per-TLD TLS adoption is a proxy for how aggressively a platform pushes its customers to current defaults. A platform serving a TLD with 99%+ TLS 1.3 adoption has made the upgrade invisible; one serving a TLD at 73% has left it as homework. That difference shows up in every protocol and security control, not just TLS version.

Where your own domain stands

Check your domain free at defaults.exposed — see exactly how your domain scores on TLS version negotiation along with 33 other security checks. Takes 30 seconds. No account needed. Read the flagship State of Domain Security 2026 report.

Also in this series: TLS 1.3 adoption report · Weak and outdated TLS · The most and least secure TLDs

How to cite this report

Press / blog: defaults.exposed (2026). TLS 1.3 by Country: Which TLDs Win on Defaults (2026). defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/tls-13-by-country-tld-map

Academic: defaults.exposed. (2026, August 18). TLS 1.3 by Country: Which TLDs Win on Defaults (2026). In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/tls-13-by-country-tld-map

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=231,455,163 TLS-completing domains)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026

Aggregate data only. Data stored and processed in the EU.

Aggregate data only. Data stored and processed in the EU.