--- title: "HSTS Adoption Statistics: 61.6% of Websites Skip the Header" url: https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing description: "HSTS adoption statistics from 15,470,478 homepages: 61.6% of websites skip the header, including 48.7% of the 10,000 most popular sites. See the data." lang: en --- Share Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fhsts-security-header-missing&text=61.6%25%20of%20Websites%20Skip%20HSTS%2C%20the%20Security%20Header%20That%20Forces%20Secure%20Connections Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fhsts-security-header-missing Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fhsts-security-header-missing Share on Reddit: https://www.reddit.com/submit?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fhsts-security-header-missing&title=61.6%25%20of%20Websites%20Skip%20HSTS%2C%20the%20Security%20Header%20That%20Forces%20Secure%20Connections **61.6%** of websites do not send HSTS, the one-line setting that tells browsers to always use a secure connection. Even among the 10,000 most popular sites, 48.7% skip it. Analysis of 15,470,478 homepages · the public HTTP Archive crawl and Google's Chrome UX Report, September 2026 ## Key Findings 1. 1. **61.6%** of websites do not send HSTS, the security header that tells browsers to always load the site over a secure connection. Copy stat 2. 2. **48.7%** of the 10,000 most popular websites do not send HSTS, nearly half of the sites with the most visitors. Copy stat 3. 3. **61.9%** of websites outside the top 1 million do not send HSTS, against 57% of sites ranked from 10k to 1 million. Copy stat 4. 4. **5.9%** of websites fail a basic HTTPS check altogether, so they need a working secure connection before HSTS can help. Copy stat 5. 5. Missing HSTS is the most widespread of five website security gaps measured, ahead of the **54.9%** of websites with no web application firewall. Copy stat ## Summary A traveler in a hotel lobby types a bank's address into her browser without the https:// in front. For a split second, before the site redirects her, that first request goes out over an ordinary connection on shared Wi-Fi, which is the moment an attacker on the same network can use to intercept or redirect her. HSTS, short for HTTP Strict Transport Security, closes that gap. It is a single line a website sends that tells the browser: from now on, only connect to this site securely. It costs nothing, takes minutes to set up on most hosts, and protects every returning visitor. Most of the web does not send it. **61.6%** of websites have no HSTS header, 9,535,779 of 15,470,478 homepages. Popularity helps less than you would expect: 48.7% of the 10,000 most popular websites skip it too. ## What we measured We used the September 2026 HTTP Archive crawl, a public crawl that loads 15,470,478 homepages in a real browser and records the settings each site sends back. We counted homepages that send no HSTS header and grouped them by popularity using Google's Chrome UX Report, which ranks sites by real Chrome traffic: the 10,000 most popular, sites ranked from 10k to 1 million, and sites beyond the top 1 million. HSTS, or HTTP Strict Transport Security, is a response header: an instruction a website sends with each page telling the browser to use only HTTPS, the secure, encrypted version of the site, for a set period. We also counted homepages that fail a basic HTTPS check, and compared missing HSTS with four other security gaps measured in the same crawl. ## HSTS is missing at every level of popularity 48.7% of the 10,000 most popular websites do not send an HSTS header. The most popular sites do better, but not by as much as you might expect. Just over half of the 10,000 most popular websites send HSTS. For sites ranked from 10k to 1 million it drops to 43%, and beyond the top 1 million to 38%. The long tail dominates in raw numbers. 9,089,817 of the homepages missing HSTS rank outside the top 1 million, the small business and personal sites that rarely have anyone reviewing their server settings. Share missing by site popularity 10,000 most popular 48.7% 10k to 1 million 57% Beyond the top 1 million 61.9% All websites 61.6% Source: Suff Digital analysis of 15,470,478 homepages · the public HTTP Archive crawl and Google's Chrome UX Report, September 2026 | Site popularity | Homepages | No HSTS header | Share missing | | --- | --- | --- | --- | | 10,000 most popular | 7,500 | 3,654 | 48.7% | | 10k to 1 million | 775,350 | 442,308 | 57% | | Beyond the top 1 million | 14,687,628 | 9,089,817 | 61.9% | | All websites | 15,470,478 | 9,535,779 | 61.6% | ## Why HSTS matters more than it looks Most sites now redirect http:// to https://. But a redirect happens after the browser has already sent the first request in the clear. HSTS removes that step for returning visitors, and sites on the browser preload list get the protection from the very first visit. On the other side of the numbers, 5,934,699 homepages do send HSTS, including 3,846 of the 10,000 most popular. HSTS also needs a working HTTPS setup first, and 5.9% of homepages still fail a basic HTTPS check, so those sites have to fix their secure connection before HSTS can help. ## HSTS is the most common security gap measured Set against four other security checks in the same September 2026 crawl, missing HSTS is the most widespread problem. It affects more homepages than having no web application firewall, a filter that blocks common attacks before they reach the site, and more than twice as many as loading a JavaScript library with a known vulnerability. Share of homepages by security gap No HSTS header 61.6% No web application firewall or edge security layer 54.9% Loads a JavaScript library with a known vulnerability 28.7% Fails a basic HTTPS check 5.9% HTTPS page loading insecure HTTP content 4.5% A site that has never set HSTS has often never had its response headers reviewed at all, which makes the header a useful first check of how well a site is looked after. ## What this means for website owners and developers Check your site with a free header scanner, or in your browser's developer tools under Network, then Response Headers. If Strict-Transport-Security is missing, add it at the server, CDN or hosting level. Start with a short max-age, confirm nothing breaks, then raise it to a year and include subdomains once all of them support HTTPS. While you are there, add Content-Security-Policy, X-Frame-Options and X-Content-Type-Options. Most hosts and CDNs let you set these without touching the site's code. Security headers are part of ongoing website management (https://www.suffdigital.com/services/website-maintenance/website-management): set once, then checked whenever the host, CDN or site setup changes. ## Embed this research Paste this on your site to embed the charts. It links back to the source automatically.

Source: 61.6% of Websites Skip HSTS, the Security Header That Forces Secure Connections - Suff Digital

## Cite this study APA Suff Digital. (2026). 61.6% of Websites Skip HSTS, the Security Header That Forces Secure Connections. https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing Plain link 61.6% of Websites Skip HSTS, the Security Header That Forces Secure Connections - Suff Digital - https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing ## Frequently asked questions ### How many websites are missing the HSTS header? ### Do popular websites use HSTS? ### What does HSTS do? ### Is missing HSTS the most common website security gap? ## Related studies - Website Maintenance Nearly 3 in 10 Websites Load a JavaScript Library With a Known Security Flaw: https://www.suffdigital.com/resources/data-studies/vulnerable-javascript-libraries - Website Maintenance 58% of Small Websites Have No Web Application Firewall vs 34.4% of the Top 10,000: https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall - Website Maintenance 48.1% of Websites That Show Their PHP Version Run One With No Security Fixes: https://www.suffdigital.com/resources/data-studies/end-of-life-php-versions - Website Maintenance Small Business Website Upkeep: 11.5% of Domain Names Are Due to Expire Within 60 Days: https://www.suffdigital.com/resources/data-studies/small-business-website-upkeep ## Structured data ```json [ { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://www.suffdigital.com/#organization", "name": "Suff Digital", "alternateName": "Suff Digital Marketing", "url": "https://www.suffdigital.com/", "logo": { "@type": "ImageObject", "@id": "https://www.suffdigital.com/#logo", "url": "https://www.suffdigital.com/logo.png", "contentUrl": "https://www.suffdigital.com/logo.png", "caption": "Suff Digital" }, "image": { "@id": "https://www.suffdigital.com/#logo" }, "description": "Suff Digital is a full-stack digital marketing agency that turns websites into predictable revenue engines, SEO, paid media, content, CRO, and web design built around revenue, not vanity metrics.", "slogan": "Digital marketing built for what's next.", "email": "hello@suffdigital.com", "telephone": "+1-629-236-0099", "foundingDate": "2022", "founder": { "@type": "Person", "name": "Matt Suffoletto", "jobTitle": "Founder & CEO" }, "contactPoint": [ { "@type": "ContactPoint", "telephone": "+1-629-236-0099", "email": "hello@suffdigital.com", "contactType": "sales", "areaServed": "US", "availableLanguage": [ "en" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Nashville", "addressRegion": "TN", "postalCode": "37219", "addressCountry": "US" }, "areaServed": { "@type": "Country", "name": "United States" }, "sameAs": [ "https://www.linkedin.com/company/suff-digital/", "https://www.instagram.com/suffdigital/", "https://www.youtube.com/@suffdigitalmarketing", "https://www.tiktok.com/@suffdigital" ], "knowsAbout": [ "Search Engine Optimization", "Pay-Per-Click Advertising", "Paid Social Advertising", "Conversion Rate Optimization", "Web Design", "Digital PR", "Link Building", "Website Migration", "Website Maintenance and Support", "Technical SEO", "Local SEO", "AI Search Optimization" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Suff Digital Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Search Engine Optimization (SEO)", "url": "https://www.suffdigital.com/" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Pay-Per-Click (PPC) Advertising", "url": "https://www.suffdigital.com/services/ppc" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Paid Social Advertising", "url": "https://www.suffdigital.com/services/paid-social" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Conversion Rate Optimization (CRO)", "url": "https://www.suffdigital.com/services/cro" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Web Design", "url": "https://www.suffdigital.com/services/web-design" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Digital PR & Link Building", "url": "https://www.suffdigital.com/services/digital-pr" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Website Migration", "url": "https://www.suffdigital.com/services/website-migration" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Website Maintenance & Support", "url": "https://www.suffdigital.com/services/website-maintenance" } } ] } }, { "@type": "WebSite", "@id": "https://www.suffdigital.com/#website", "url": "https://www.suffdigital.com/", "name": "Suff Digital", "inLanguage": "en-US", "publisher": { "@id": "https://www.suffdigital.com/#organization" } } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "Article", "@id": "https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing#article", "headline": "61.6% of Websites Skip HSTS, the Security Header That Forces Secure Connections", "description": "61.6% of websites do not send HSTS, the one-line setting that tells browsers to always use a secure connection. Even among the 10,000 most popular sites, 48.7% skip it.", "image": [ "https://www.suffdigital.com/images/suff-digital-share-16x9.jpg" ], "url": "https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing", "datePublished": "2026-09-24", "dateModified": "2026-09-24", "author": { "@type": "Person", "name": "Matt Suffoletto", "jobTitle": "Founder & CEO", "url": "https://www.suffdigital.com/who-we-are" }, "publisher": { "@id": "https://www.suffdigital.com/#organization" }, "mainEntityOfPage": { "@id": "https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing", "@type": "WebPage" }, "isPartOf": { "@id": "https://www.suffdigital.com/#website" } }, { "@type": "BreadcrumbList", "@id": "https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://www.suffdigital.com/" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://www.suffdigital.com/resources" }, { "@type": "ListItem", "position": 3, "name": "Data Studies", "item": "https://www.suffdigital.com/resources/data-studies" }, { "@type": "ListItem", "position": 4, "name": "61.6% of Websites Skip HSTS, the Security Header That Forces Secure Connections" } ] }, { "@type": "Dataset", "@id": "https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing#dataset", "name": "61.6% of Websites Skip HSTS, the Security Header That Forces Secure Connections", "description": "61.6% of websites do not send HSTS, the one-line setting that tells browsers to always use a secure connection. Even among the 10,000 most popular sites, 48.7% skip it.", "url": "https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing", "creator": { "@id": "https://www.suffdigital.com/#organization" }, "datePublished": "2026-09-24", "dateModified": "2026-09-24", "license": "https://creativecommons.org/licenses/by/4.0/", "isAccessibleForFree": true, "measurementTechnique": "The public HTTP Archive crawl of 15.5 million websites; Google's Chrome UX Report for site popularity" }, { "@type": "FAQPage", "@id": "https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing#faq", "mainEntity": [ { "@type": "Question", "name": "How many websites are missing the HSTS header?", "acceptedAnswer": { "@type": "Answer", "text": "61.6% of websites send no HSTS header, 9,535,779 of 15,470,478 homepages in the September 2026 HTTP Archive crawl." } }, { "@type": "Question", "name": "Do popular websites use HSTS?", "acceptedAnswer": { "@type": "Answer", "text": "About half do. 48.7% of the 10,000 most popular websites are missing HSTS, against 61.9% of websites beyond the top 1 million." } }, { "@type": "Question", "name": "What does HSTS do?", "acceptedAnswer": { "@type": "Answer", "text": "HSTS tells browsers to always load a site over a secure HTTPS connection, closing the gap before an http to https redirect happens." } }, { "@type": "Question", "name": "Is missing HSTS the most common website security gap?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, of the five gaps measured. 61.6% of websites send no HSTS header, against 54.9% with no web application firewall and 28.7% loading a JavaScript library with a known vulnerability." } } ] } ] } ] ```