HPKP on new websites
HTTP Public Key Pinning, a deprecated header that pinned a site to specific TLS certificates.
- Sites using HPKP
- 49
- since Jul 2026
- Last 30 days
- 0.0%
-
of new sites, to Oct 19
no change on the 30 days before - Last 7 days
- 0.0%
- of new sites, 7-day average
no change on the week before
| First seen | Jul 14, 2026 |
|---|---|
| Last seen | Oct 18, 2026 |
What we found
- HPKP appeared on about 22 new sites in the last 30 days.[1]
Share of new sites using HPKP
The line is the 7-day average share of new sites that use HPKP, since 10 September.
Who uses HPKP
| Type | Sites | Share | Bar |
|---|---|---|---|
| Finance | 4 | 30.8% | |
| Productivity | 3 | 23.1% | |
| AI | 1 | 7.7% | |
| Developer Tools | 1 | 7.7% | |
| E-commerce | 1 | 7.7% | |
| Games | 1 | 7.7% | |
| Health | 1 | 7.7% | |
| Marketing | 1 | 7.7% |
| Ending | Sites | Share | Bar |
|---|---|---|---|
| .com | 32 | 65.3% | |
| .co | 4 | 8.2% | |
| .net | 3 | 6.1% | |
| .es | 2 | 4.1% | |
| .org | 2 | 4.1% | |
| .ai | 1 | 2.0% | |
| .de | 1 | 2.0% | |
| .dev | 1 | 2.0% |
Security on new sites
| # | Movement | Tool | Share of category | Bar | |
|---|---|---|---|---|---|
| 1 | – | HSTS | 87.4% | ||
| 2 | – |
Cloudflare Bot Management
|
25.2% | ||
| 3 | – |
Google reCAPTCHA
|
3.5% | ||
| 4 | ▲1 |
Anubis
|
0.2% | ||
| 5 | ▼2 |
DDoS-Guard
|
0.2% | ||
| … | |||||
| 47 | ▲6 | HPKP | <0.1% | ||
All-time shares across the new sites we track: of all of them, and of the sites using any Security tool. Among September launches it ranked #44 in Security, up from #50 in August. All 400 in Security
Recently launched products built on HPKP
3 of the 49 sites using HPKP are product launches we list individually. The other 46 are new business and personal sites: they count towards the figures above but are not listed here. A watch sends them to you.
United States
Watches, exports and the API give you all 49 sites using HPKP, from £15 a month.
Notes
- These figures cover websites that went live since April 2026, not the web as a whole.
How this page is made
FirstSited looks at each new website near the day it goes live and records what it was built with. We do not go back later, so these figures describe what sites launch with, not what they run today. A site counts towards HPKP when we detect HPKP on it at that look.
Every share on this page is a proportion of the new sites we were tracking at the time. Sites we found across the wider web count towards the figures, but only product launches are listed by name. How we detect technologies · How we find new sites