HSTS on new websites
Web security policy that tells browsers to load a site only over HTTPS, blocking downgrades to plain HTTP.
- Sites using HSTS
- 2,878,540
- since Apr 2026
- Last 30 days
- 45.6%
-
of new sites, to Oct 19
-2.3 pts on the 30 days before - Last 7 days
- 45.5%
- of new sites, 7-day average
+0.5 pts on the week before
| In our data since | Apr 2026 |
|---|---|
| Last seen | Oct 20, 2026 |
| Website | developer.mozilla.org |
What we found
- About 1 in 2 websites that went live in the last 30 days use HSTS (45.6%).[1]
- It is the most common security service on new sites, more than twice as common as the next, Cloudflare Bot Management.
Share of new sites using HSTS
The line is the 7-day average share of new sites that use HSTS, since 10 September.
Who uses HSTS
| Type | Sites | Share | Bar |
|---|---|---|---|
| E-commerce | 165,417 | 17.0% | |
| Health | 132,050 | 13.6% | |
| Finance | 83,342 | 8.6% | |
| Education | 79,778 | 8.2% | |
| Productivity | 77,962 | 8.0% | |
| Marketing | 77,133 | 7.9% | |
| Developer Tools | 69,542 | 7.2% | |
| Content | 57,622 | 5.9% | |
| Games | 50,528 | 5.2% | |
| AI | 46,174 | 4.8% | |
| Social | 44,655 | 4.6% | |
| Design | 31,386 | 3.2% |
| Country | Sites | Share | Bar |
|---|---|---|---|
| 74,548 | 16.0% | ||
| 73,591 | 15.8% | ||
| 71,160 | 15.3% | ||
| 61,676 | 13.2% | ||
| 34,773 | 7.5% | ||
| 14,249 | 3.1% | ||
| 13,831 | 3.0% | ||
| 13,155 | 2.8% | ||
| 10,745 | 2.3% | ||
| 10,020 | 2.2% | ||
| 8,979 | 1.9% | ||
| 7,117 | 1.5% |
| Ending | Sites | Share | Bar |
|---|---|---|---|
| .com | 1,684,641 | 58.6% | |
| .app | 144,868 | 5.0% | |
| .in | 82,510 | 2.9% | |
| .online | 79,093 | 2.8% | |
| .org | 77,932 | 2.7% | |
| .uk | 75,777 | 2.6% | |
| .store | 67,301 | 2.3% | |
| .fr | 59,187 | 2.1% | |
| .co | 54,807 | 1.9% | |
| .net | 51,007 | 1.8% | |
| .site | 50,185 | 1.7% | |
| .ca | 45,249 | 1.6% |
| Sites | Green | Bar |
|---|---|---|
| HSTS | 34% | |
| All new sites | 47% |
Security on new sites
| # | Movement | Tool | Share of category | Bar |
|---|---|---|---|---|
| 1 | – | HSTS | 87.4% | |
| 2 | – |
|
25.2% | |
| 3 | – |
|
3.5% | |
| 4 | ▲1 |
|
0.2% | |
| 5 | ▼2 |
|
0.2% |
All-time shares across the new sites we track: of all of them, and of the sites using any Security tool. HSTS is typically used alongside Cloudflare Bot Management rather than instead of it. All 400 in Security
Often used with HSTS
| Tool | Sites with both | vs all new sites |
|---|---|---|
|
|
787,980 | 2.1x |
Tools that turn up far more often on HSTS sites than on new sites in general, and how many times as common each one is there.
Recently launched products built on HSTS
680,806 of the 2,878,540 sites using HSTS are product launches we list individually. The other 2,197,734 are new business and personal sites: they count towards the figures above but are not listed here. A watch sends them to you.
Showing the most recent 12 of 680,806.
Watches, exports and the API give you all 2,878,540 sites using HSTS, from £15 a month.
Notes
- These figures cover websites that went live since April 2026, not the web as a whole.
- Country comes from what each site says about itself, such as a company registration, legal terms or a phone number, not just its domain ending. Too few sites state their country plainly for the usual count, so this one also counts single signals: a country domain ending, a phone number (for North America, its area code), a location the site declares in its own page metadata, or a country-specific vendor stack and the page language where they agree and nothing contradicts them. Read these as likely rather than certain.
- Green hosting is the share whose web host The Green Web Foundation lists as running on green energy, among sites checked since 1 April 2026, against the same share for every new site we checked over that time. Data from The Green Web Foundation.
How this page is made
FirstSited looks at each new website near the day it goes live and records what it was built with. We do not go back later, so these figures describe what sites launch with, not what they run today. A site counts towards HSTS when we detect HSTS on it at that look.
Every share on this page is a proportion of the new sites we were tracking at the time. Sites we found across the wider web count towards the figures, but only product launches are listed by name. How we detect technologies · How we find new sites