Security Tools

1. HSTS runs on more than half of the sites using a security tool (87%), 3.5 times as many sites as Cloudflare Bot Management.
2. Only 3 of the 399 security tools we track run on more than 1% of these sites.
3. Among sites launched in September, Cloudflare Waiting Room rose to #11 from #15 in August.
4. Tencent Captcha is a regional leader, used almost entirely by sites in China.

#	Movement	Tool	Country	Share	Bar	Sites	90 days
1	–	H HSTS Web security policy that tells browsers to load a site only over HTTPS, blocking downgrades to plain HTTP.		87%		2,853,456
2	–	Cloudflare Bot Management Paid add-on that scores incoming requests for bot likelihood.		25%		822,604
3	–	Google reCAPTCHA Bot-detection challenge service used to gate forms and logins against automated abuse.		3.5%		114,570
4	▲1	Anubis Open-source proof-of-work anti-bot challenge proxy.		0.2%		5,681
5	▼2	DDoS-Guard Russian DDoS protection, CDN, and reverse proxy provider.		0.2%		4,952
6	▲1	BitNinja Server-side security suite and web application firewall that filters malicious traffic.		0.1%		4,449
7	–	PerimeterX PerimeterX (now HUMAN): bot mitigation and account-takeover protection for web apps and APIs.		<0.1%		3,082
8	▼1	Firebase App Check Google attestation service to verify requests come from your app.		<0.1%		2,782
9	▲1	Altcha Open-source proof-of-work CAPTCHA alternative; uses a TXT DNS record for domain verification		<0.1%		2,178
10	▲1	CleanTalk Anti-spam, security, and form protection service popular as a WordPress plugin.		<0.1%		1,482
11	▼3	TrustedSite Site security and trust badge program (formerly McAfee SECURE) showing scan and certification badges.		<0.1%		1,350
12	▲4	Cloudflare Waiting Room Virtual queue that holds excess visitors in a waiting room to protect an origin from traffic surges.		<0.1%		944
13	▲1	Imperva Cloud web application firewall and DDoS protection.		<0.1%		904
14	▼2	Tencent Captcha Bot-detection challenge service from Tencent Cloud, popular on Chinese websites.		<0.1%		822
15	▲1	Secure-Mailgate German email security gateway for inbound/outbound protection		<0.1%		700

Share is of the 3,261,973 sites using a security tool; a site can use more than one. A flag means nearly all of a tool's sites are in that country. Arrows compare each tool's rank among sites launched in September with August. The line is its share of new sites over 90 days. Showing the top 15 of 399.

Watches, exports and the API give you every security tool and the sites using each, from £15 a month.

Other kinds of tool most often found on the same sites, leaving out the plumbing every site has (DNS, CDN, hosting).

• Analytics 48,014
• CSS Framework 47,753
• Framework 45,107
• Meta Framework 39,861
• UI Library 29,488
• Font 27,456