--- title: "Download list of all HSTS sites" description: "Every website running HSTS, with domain, DNS, WHOIS, IP address, hosting country and global rank on each row. One file, rebuilt daily." url: https://webatla.com/technology/hsts --- [Home](https://webatla.com/) › [Technologies](https://webatla.com/technology) › [Security](https://webatla.com/technology?category=Security) › HSTS ![HSTS logo](https://webatla.com/assets/tech-logos/hsts.png) # Download websites that use HSTS 53,645,322 live sites using HSTS right now Security · since 2012 53.6M sites, Dataset updated · 2026-10-27 Categories [Security](https://webatla.com/technology?category=Security) [🔒 Get the list](https://webatla.com/technology/hsts#preview) Requires a dataset purchase [About HSTS](https://webatla.com/technology/hsts#overview) [Database preview](https://webatla.com/technology/hsts#preview) [By country](https://webatla.com/technology/hsts#by-country) [By TLD](https://webatla.com/technology/hsts#by-tld) [Download](https://webatla.com/technology/hsts#download) All figures as of Oct 27, 2026 All figures here come from one snapshot of the webatla database, taken on this date (UTC). We usually refresh it every day. 53,645,322, Sites detected 16.9%, Of all websites ## Preview HSTS site datasets HSTS detection is a value inside the **Technologies** column. Two datasets carry it. **Technologies · €159 / month · 53,645,322 rows · 14 columns · webatla-technologies-hsts-2026-10-27.jsonl.zst** | Domain | TLD suffix | TLD | Domain type | HTTP status | IP address | Country by IP | Social networks | Technologies last data checked | Technologies | PR value | Harmonic value | Domain creation date | Domain expiration date | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | facebook.com | [com](https://webatla.com/tld/com) | [com](https://webatla.com/tld/com) | ICANN | HTTP 200 | 157.240.0.35 | [DE](https://webatla.com/country/de) | {…} | 2026-10-15 | HSTS, HTTP/3, Favicon, DigiCert, Google Site Verification, Facebook Domain Verification | 0.00868451 | 30,198,380 | 1997-03-29 | 2034-03-30 | | youtube.com | [com](https://webatla.com/tld/com) | [com](https://webatla.com/tld/com) | ICANN | HTTP 200 | 142.251.13.136 | [US](https://webatla.com/country/us) | {…} | 2026-09-23 | HSTS, HTTP/3, Favicon, YouTube, Open Graph, Priority Hints, Google Font API, Google Site Verification, Facebook Domain Verification | 0.00470753 | 26,246,026 | 2005-02-15 | 2027-02-15 | | linkedin.com | [com](https://webatla.com/tld/com) | [com](https://webatla.com/tld/com) | ICANN | HTTP 200 | 130.211.32.14 | [US](https://webatla.com/country/us) | {…} | 2026-10-22 | HSTS, Java, Miro, Azure, HTTP/3, Favicon, DigiCert, DocuSign, hreflang, Atlassian | 0.00398415 | 24,984,864 | 2002-11-02 | 2026-11-02 | | github.com | [com](https://webatla.com/tld/com) | [com](https://webatla.com/tld/com) | ICANN | HTTP 200 | 20.250.119.67 | [CH](https://webatla.com/country/ch) | {…} | 2026-10-17 | PWA, HSTS, Miro, React, HTTP/2, OpenAI, Stripe, Favicon, Sectigo, Zendesk | 0.00195736 | 21,245,098 | 2007-10-09 | 2028-10-09 | | wordpress.org | [org](https://webatla.com/tld/org) | [org](https://webatla.com/tld/org) | ICANN | HTTP 200 | 66.6.42.252 | [US](https://webatla.com/country/us) | {…} | 2026-09-21 | Google Analytics G-3QKGGJJZ7H G-3WHS0F939W G-5397EW9JFD G-BBCHFYJHX8 G-RBLL3R0NS5 G-RN0YKJ932Z G-W1RN9F1RVW UA-52447-1 +7 , Google Tag Manager GTM-P24PF4B , PHP, RSS, HSTS, MySQL, Nginx, HTTP/2… | 0.00187428 | 21,492,182 | 2003-03-28 | 2035-03-28 | **All data · €599 / month · 53,645,322 rows · 23 columns · webatla-all-data-hsts-2026-10-27.jsonl.zst** | Domain | TLD suffix | TLD | Domain type | HTTP status | IP address | Country by IP | Social networks | Technologies last data checked | Technologies | DNS last data checked | DNS Status | DNS records | PR value | Harmonic value | RDAP/WHOIS last data checked | RDAP/WHOIS method | Domain creation date | Domain expiration date | Domain last changed | Registrar | RDAP/WHOIS Record | Response Status RDAP/WHOIS | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | facebook.com | [com](https://webatla.com/tld/com) | [com](https://webatla.com/tld/com) | ICANN | HTTP 200 | 157.240.0.35 | [DE](https://webatla.com/country/de) | {…} | 2026-10-15 | HSTS, HTTP/3, Favicon, DigiCert, Google Site Verification, Facebook Domain Verification | 2026-10-18 | TRUE | {…} | 0.00868451 | 30,198,380 | 2025-06-15 | RDAP | 1997-03-29 | 2034-03-30 | 2025-06-15 | RegistrarSafe, LLC | {…} | Domain is active | | youtube.com | [com](https://webatla.com/tld/com) | [com](https://webatla.com/tld/com) | ICANN | HTTP 200 | 142.251.13.136 | [US](https://webatla.com/country/us) | {…} | 2026-09-23 | HSTS, HTTP/3, Favicon, YouTube, Open Graph, Priority Hints, Google Font API, Google Site Verification, Facebook Domain Verification | 2026-10-15 | TRUE | {…} | 0.00470753 | 26,246,026 | 2026-01-17 | RDAP | 2005-02-15 | 2027-02-15 | 2026-01-17 | MarkMonitor Inc. | {…} | Domain is active | | linkedin.com | [com](https://webatla.com/tld/com) | [com](https://webatla.com/tld/com) | ICANN | HTTP 200 | 130.211.32.14 | [US](https://webatla.com/country/us) | {…} | 2026-10-22 | HSTS, Java, Miro, Azure, HTTP/3, Favicon, DigiCert, DocuSign, hreflang, Atlassian | 2026-10-24 | TRUE | {…} | 0.00398415 | 24,984,864 | 2025-10-04 | RDAP | 2002-11-02 | 2026-11-02 | 2025-10-03 | MarkMonitor Inc. | {…} | Domain is active | | github.com | [com](https://webatla.com/tld/com) | [com](https://webatla.com/tld/com) | ICANN | HTTP 200 | 20.250.119.67 | [CH](https://webatla.com/country/ch) | {…} | 2026-10-17 | PWA, HSTS, Miro, React, HTTP/2, OpenAI, Stripe, Favicon, Sectigo, Zendesk | 2026-10-21 | TRUE | {…} | 0.00195736 | 21,245,098 | 2026-10-08 | RDAP | 2007-10-09 | 2028-10-09 | 2026-09-07 | MarkMonitor Inc. | {…} | Domain is active | | wordpress.org | [org](https://webatla.com/tld/org) | [org](https://webatla.com/tld/org) | ICANN | HTTP 200 | 66.6.42.252 | [US](https://webatla.com/country/us) | {…} | 2026-09-21 | Google Analytics G-3QKGGJJZ7H G-3WHS0F939W G-5397EW9JFD G-BBCHFYJHX8 G-RBLL3R0NS5 G-RN0YKJ932Z G-W1RN9F1RVW UA-52447-1 +7 , Google Tag Manager GTM-P24PF4B , PHP, RSS, HSTS, MySQL, Nginx, HTTP/2… | 2026-10-18 | TRUE | {…} | 0.00187428 | 21,492,182 | 2026-03-29 | RDAP | 2003-03-28 | 2035-03-28 | 2025-07-06 | MarkMonitor Inc. | {…} | Domain is active | [↓ Download preview (20 rows, free)](https://webatla.com/api/v1/sample/technology/hsts?dataset=technologies) [Buy Technologies · €159 / month](https://webatla.com/account/checkout?dataset=technologies) ## HSTS sites by country | Country | Sites | Share | | --- | --- | --- | | 🇺🇸 [United States](https://webatla.com/country/us) | 32,781,208 | 64.8% | | 🇨🇦 [Canada](https://webatla.com/country/ca) | 4,148,589 | 8.2% | | 🇩🇪 [Germany](https://webatla.com/country/de) | 3,400,609 | 6.7% | | 🇭🇰 [Hong Kong](https://webatla.com/country/hk) | 1,293,745 | 2.6% | | 🇦🇪 [United Arab Emirates](https://webatla.com/country/ae) | 1,075,383 | 2.1% | ## HSTS sites by TLD | TLD | Sites | Share | | --- | --- | --- | | [.com](https://webatla.com/tld/com) | 27,446,936 | 51.2% | | [.org](https://webatla.com/tld/org) | 1,756,442 | 3.3% | | [.de](https://webatla.com/tld/de) | 1,486,443 | 2.8% | | [.net](https://webatla.com/tld/net) | 1,359,967 | 2.5% | | [.uk](https://webatla.com/tld/uk) | 1,340,461 | 2.5% | ## The HSTS dataset Every site we've detected as running HSTS, with version, hosting, country, TLD and traffic rank. ### HSTS lives inside 2 datasets HSTS detection is part of **Technologies** (€159/mo) and **All data** (€599/mo). Buy either to filter the full 53,645,322-site list, or grab a free preview first. [See datasets](https://webatla.com/pricing) [↓ Download free preview (20 rows)](https://webatla.com/api/v1/sample/technology/hsts?dataset=technologies) ## About HSTS ### At a glance - **Website:** rfc-editor.org ↗ - **First release:** 2012-01-01 Most security markers are cheap to add and cheap to remove. HSTS is neither, and the difference is what makes the column worth reading. The header instructs browsers to refuse plain connections to the domain for a stated period, and once it has been served and cached there is no quick way to take it back. An operator who sends it has accepted that a certificate mistake becomes an outage rather than a warning, which is a decision somebody had to be confident enough to make. The mechanism was standardised in 2012 to close protocol downgrade and cookie hijacking attacks, and as of October 2026 we see the header on 53,645,322 sites. Filing it under Security states the obvious. The more useful framing is organisational, because presence is evidence that somebody in that organisation understood a trade off and acted on it, and that is a rare thing to be able to infer about a stranger from a public scan. Several audiences buy exactly that inference. Security vendors and consultancies want the domains that have not adopted the policy, because those domains are the addressable market for what they sell. Compliance and insurance analysts want the opposite view, using adoption as one input into a posture score for a sector or a supply chain they cannot audit directly. Threat researchers use the field to narrow their scanning, on the reasonable assumption that a domain enforcing transport security says something about the maturity of everything else behind it. United States accounts for 32,781,208 of the domains sending the header, and the suffix weight sits on .com. The pattern tracks hosting platforms and control panels that switch the policy on for their customers by default, so a strong national figure often measures a provider decision rather than a national security culture. Anyone building a sector comparison should hold the hosting column beside the country column, otherwise the conclusion will be about infrastructure wearing a flag it never chose. A per domain check is free and instant, which is rather the point. Nobody needs a dataset to learn whether one site sends the header. The questions that need the file are the ones with a denominator underneath them. What proportion of the domains in a country code suffix enforce the policy. How a bank's supplier list compares with its sector as a whole. Whether adoption inside a hosting provider's customer base jumped after the provider changed a default, and when. Denominators require the whole population in one file, joined to the other markers on the same row. Our record is deliberately narrow. We note that the header was present on the response we received, and we do not publish its duration, whether it covers subdomains, or whether the domain appears on the preload lists browsers ship. A short lived policy and a long one look identical here. Detection also depends on reaching the site, so blocks, timeouts and interstitials produce absences that are refusals to answer rather than refusals to secure. Absence means we did not observe the header, which is the honest claim, and a policy question that turns on the header's parameters needs a targeted check that this file can only tell you where to point. ## Frequently asked questions How many websites use HSTS? webatla detects HSTS on 53.6M websites, refreshed daily, each with its domain, DNS, WHOIS, IP, country and ranking. Can I download the list of websites using HSTS? Yes, as structured JSONL. Grab a free sample first. What's included for each site, and how fresh is it? Domain, DNS, RDAP/WHOIS, the full technology stack, IP & country, PageRank and Harmonic, re-detected and re-exported daily. How do I find the websites using HSTS? Buy the technology dataset, then download the complete list of domains we detect using HSTS, re-exported every day. What else is in the HSTS technology data? Each row places HSTS next to the other technology on the same site, plus DNS, WHOIS, IP, country and ranking. Can I download just the sites using HSTS, or the whole database? Both. Every site running HSTS comes in the Technologies dataset, one downloadable file. Or buy All data for the entire database: technologies plus identity, ranking, DNS and RDAP/WHOIS for every domain, combined in one file. Daily fresh export. How do I download the list of websites using HSTS? Three steps: (1) grab the free 10,000-row sample to inspect the schema, (2) buy the Technologies dataset, (3) download the full list of every domain we detect running HSTS as a JSON Lines file. It is re-exported daily, so you can re-download the freshest list any time inside your access window. Each row carries the domain plus DNS, WHOIS, IP, hosting country and rank. ## Get the full list of websites using HSTS Pick the dataset that covers what you need. Each one includes HSTS and downloads as JSONL, rebuilt daily. Technologies, 14 columns Full website tech stack per site: CMS, payments, analytics, frameworks. €159 / mo [Buy and download](https://webatla.com/account/checkout?dataset=technologies) [Download preview dataset](https://webatla.com/api/v1/preview?dataset=technologies) All data, 23 columns Everything we have, in a single package. The full webatla universe. €599 / mo [Buy and download](https://webatla.com/account/checkout?dataset=all-data) [Download preview dataset](https://webatla.com/api/v1/preview?dataset=all-data) Want to compare every dataset side by side? [Visit the pricing page](https://webatla.com/pricing) ## Related technologies [![Cloudflare Bot Management logo](https://webatla.com/assets/tech-logos/cloudflare-bot-management.png) Cloudflare Bot Management Security · 13.0M sites](https://webatla.com/technology/cloudflare-bot-management) [![reCAPTCHA logo](https://webatla.com/assets/tech-logos/recaptcha.png) reCAPTCHA Security · 4.1M sites](https://webatla.com/technology/recaptcha) [![DDoS-Guard logo](https://webatla.com/assets/tech-logos/ddos-guard.png) DDoS-Guard Security · 685K sites](https://webatla.com/technology/ddos-guard) [![hCaptcha logo](https://webatla.com/assets/tech-logos/hcaptcha.png) hCaptcha Security · 287K sites](https://webatla.com/technology/hcaptcha)