Download websites that use HSTS

About HSTS

Most security markers are cheap to add and cheap to remove. HSTS is neither, and the difference is what makes the column worth reading. The header instructs browsers to refuse plain connections to the domain for a stated period, and once it has been served and cached there is no quick way to take it back. An operator who sends it has accepted that a certificate mistake becomes an outage rather than a warning, which is a decision somebody had to be confident enough to make.

The mechanism was standardised in 2012 to close protocol downgrade and cookie hijacking attacks, and as of September 2026 we see the header on 44,622,369 sites. Filing it under Security states the obvious. The more useful framing is organisational, because presence is evidence that somebody in that organisation understood a trade off and acted on it, and that is a rare thing to be able to infer about a stranger from a public scan.

Several audiences buy exactly that inference. Security vendors and consultancies want the domains that have not adopted the policy, because those domains are the addressable market for what they sell. Compliance and insurance analysts want the opposite view, using adoption as one input into a posture score for a sector or a supply chain they cannot audit directly. Threat researchers use the field to narrow their scanning, on the reasonable assumption that a domain enforcing transport security says something about the maturity of everything else behind it.

United States accounts for 25,130,156 of the domains sending the header, and the suffix weight sits on .com. The pattern tracks hosting platforms and control panels that switch the policy on for their customers by default, so a strong national figure often measures a provider decision rather than a national security culture. Anyone building a sector comparison should hold the hosting column beside the country column, otherwise the conclusion will be about infrastructure wearing a flag it never chose.

A per domain check is free and instant, which is rather the point. Nobody needs a dataset to learn whether one site sends the header. The questions that need the file are the ones with a denominator underneath them. What proportion of the domains in a country code suffix enforce the policy. How a bank's supplier list compares with its sector as a whole. Whether adoption inside a hosting provider's customer base jumped after the provider changed a default, and when. Denominators require the whole population in one file, joined to the other markers on the same row.

Our record is deliberately narrow. We note that the header was present on the response we received, and we do not publish its duration, whether it covers subdomains, or whether the domain appears on the preload lists browsers ship. A short lived policy and a long one look identical here. Detection also depends on reaching the site, so blocks, timeouts and interstitials produce absences that are refusals to answer rather than refusals to secure. Absence means we did not observe the header, which is the honest claim, and a policy question that turns on the header's parameters needs a targeted check that this file can only tell you where to point.