HSTS on new websites

Web security policy that tells browsers to load a site only over HTTPS, blocking downgrades to plain HTTP.

Sites using HSTS
2,823,941
2,747,934 found by StackScope, 76,007 via launch platforms
Last 30 days
45.5%
of new sites, to Oct 18
-2.5 pts on the 30 days before
Last 7 days
45.4%
of new sites, 7-day average
+0.4 pts on the week before
Rank in Security
#1
of 398 tools, all time
Found via
  • StackScope Wider Web 2,155,317
  • StackScope Discovery (Indie) 592,617
  • Product Hunt 58,056
  • Other 8,187
  • PeerPush 5,239
  • Hacker News 4,525
In our data since Apr 2026
Last seen Oct 19, 2026
Most recent launch ConvertLayer — Free PDF Converter & AI Document Tools, Oct 19, 2026
Website developer.mozilla.org
View

What we found

  1. About 1 in 2 websites that went live in the last 30 days use HSTS (45.5%).[1]
  2. It is the most common security service on new sites, more than twice as common as the next, Cloudflare Bot Management.

Share of new sites using HSTS

0% 20% 40% 60% 80% Apr Jun Aug Oct [2] [3]

The line is the 7-day average share of new sites that use HSTS, day by day for the last 90 days and weekly before that (left of the dashed line). The shaded areas were measured against a different set of sites, so the line can step there without HSTS itself changing.[2][3]

Who uses HSTS

Kind of site 953,573 sites with a known type, all time
TypeSitesShareBar
E-commerce 162,120 17.0%
Health 129,616 13.6%
Finance 81,883 8.6%
Education 78,359 8.2%
Productivity 76,706 8.0%
Marketing 75,862 8.0%
Developer Tools 68,458 7.2%
Content 56,530 5.9%
Games 49,306 5.2%
AI 45,358 4.8%
Social 43,806 4.6%
Design 30,854 3.2%
Crypto 23,112 2.4%
Hiring & HR 22,476 2.4%
Directory 9,127 1.0%
Country[4] likely for 448,951 of 2,823,941 sites (15.9%)
CountrySitesShareBar
United Kingdom 71,572 15.9%
United States 69,812 15.6%
India 69,192 15.4%
France 60,439 13.5%
Canada 33,949 7.6%
Brazil 13,439 3.0%
Switzerland 12,917 2.9%
Australia 12,846 2.9%
Sweden 10,478 2.3%
South Korea 9,719 2.2%
Germany 8,676 1.9%
Spain 6,749 1.5%
Japan 4,856 1.1%
New Zealand 4,788 1.1%
Türkiye 4,586 1.0%
Domain ending 2,823,580 sites, all time
EndingSitesShareBar
.com 1,652,375 58.5%
.app 143,028 5.1%
.in 80,999 2.9%
.online 78,040 2.8%
.org 76,645 2.7%
.uk 74,123 2.6%
.store 66,035 2.3%
.fr 58,227 2.1%
.co 54,179 1.9%
.net 50,090 1.8%
.site 49,533 1.8%
.ca 44,726 1.6%
.xyz 41,681 1.5%
.ai 41,350 1.5%
.dev 39,111 1.4%
Green hosting[5] 75,982 checked sites since Apr 2026
SitesGreenBar
Using HSTS 34%
Every new site we checked 47%

Security on new sites

# Movement Tool Share of all sites Share of category Bar
1 – HSTS 47.5% 87.4%
2 – Cloudflare Bot Management 13.7% 25.2%
3 – Google reCAPTCHA 1.9% 3.5%
4 ▲1 Anubis 0.1% 0.2%
5 ▼2 DDoS-Guard 0.1% 0.2%

All-time shares across the new sites we track: of all of them, and of the sites using any Security tool. HSTS is typically used alongside Cloudflare Bot Management rather than instead of it. All 398 in Security

Often used with HSTS

Tool Sites with both vs all new sites Bar
Vercel 775,200 2.1x

Tools that turn up far more often on HSTS sites than on new sites in general, and how many times as common each one is there.

Recent launches using HSTS

Notes

  1. These figures cover websites that went live since April 2026, not the web as a whole.
  2. Grey: before 8 July 2026, we only tracked launches from launch platforms. From that date we crawl the wider web as well, so the share is measured against a much larger set of sites. For one continuous measure, view launch platforms only.
  3. Amber: 8 July to 10 September 2026, before we improved our infrastructure to index new sites much sooner, often on the day they go live. Sites found that early often haven't finished setting up, so anything usually added after launch reads lower from 10 September. We record each site as it was when we found it.
  4. Country comes from what each site says about itself, such as a company registration, legal terms or a phone number, not just its domain ending. Too few sites state their country plainly for the usual count, so this one also counts single signals: a country domain ending, a phone number (for North America, its area code), a location the site declares in its own page metadata, or a country-specific vendor stack and the page language where they agree and nothing contradicts them. Read these as likely rather than certain.
  5. Green hosting is the share whose web host The Green Web Foundation lists as running on green energy, among sites checked since 1 April 2026, against the same share for every new site we checked over that time. Data from The Green Web Foundation.

How this page is made

StackScope looks at each new website near the day it goes live and records what it was built with. We do not go back later, so these figures describe what sites launch with, not what they run today. A site counts towards HSTS when we detect HSTS on it at that look.

Every share on this page is a proportion of the new sites we were tracking at the time. Sites we found across the wider web count towards the figures, but only product launches are listed by name. How StackScope detects technologies · How StackScope Discovery works

Something not look right? If a technology shown here is wrong or out of date, email [email protected] and we'll review it.