HSTS on new websites

Web security policy that tells browsers to load a site only over HTTPS, blocking downgrades to plain HTTP.

Sites using HSTS
2,878,540
since Apr 2026
Last 30 days
45.6%
of new sites, to Oct 19
-2.3 pts on the 30 days before
Last 7 days
45.5%
of new sites, 7-day average
+0.5 pts on the week before
Rank in Security
#1
of 400 tools, all time
In our data since Apr 2026
Last seen Oct 20, 2026
Website developer.mozilla.org

What we found

  1. About 1 in 2 websites that went live in the last 30 days use HSTS (45.6%).[1]
  2. It is the most common security service on new sites, more than twice as common as the next, Cloudflare Bot Management.

Share of new sites using HSTS

0% 20% 40% 60% 10 Sep Oct

The line is the 7-day average share of new sites that use HSTS, since 10 September.

Who uses HSTS

Kind of site 971,348 sites with a known type
TypeSitesShareBar
E-commerce 165,417 17.0%
Health 132,050 13.6%
Finance 83,342 8.6%
Education 79,778 8.2%
Productivity 77,962 8.0%
Marketing 77,133 7.9%
Developer Tools 69,542 7.2%
Content 57,622 5.9%
Games 50,528 5.2%
AI 46,174 4.8%
Social 44,655 4.6%
Design 31,386 3.2%
Country[2] 465,810 sites with a likely country
CountrySitesShareBar
US 74,548 16.0%
UK 73,591 15.8%
India 71,160 15.3%
France 61,676 13.2%
Canada 34,773 7.5%
Australia 14,249 3.1%
Brazil 13,831 3.0%
Switzerland 13,155 2.8%
Sweden 10,745 2.3%
South Korea 10,020 2.2%
Germany 8,979 1.9%
Spain 7,117 1.5%
Domain ending 2,876,014 sites
EndingSitesShareBar
.com 1,684,641 58.6%
.app 144,868 5.0%
.in 82,510 2.9%
.online 79,093 2.8%
.org 77,932 2.7%
.uk 75,777 2.6%
.store 67,301 2.3%
.fr 59,187 2.1%
.co 54,807 1.9%
.net 51,007 1.8%
.site 50,185 1.7%
.ca 45,249 1.6%
Green hosting[3] 76,995 checked sites since Apr 2026
SitesGreenBar
HSTS 34%
All new sites 47%

Security on new sites

# Movement Tool Share of all sites Share of category Bar
1 – HSTS 47.5% 87.4%
2 – Cloudflare Bot Management 13.7% 25.2%
3 – Google reCAPTCHA 1.9% 3.5%
4 ▲1 Anubis 0.1% 0.2%
5 ▼2 DDoS-Guard 0.1% 0.2%

All-time shares across the new sites we track: of all of them, and of the sites using any Security tool. HSTS is typically used alongside Cloudflare Bot Management rather than instead of it. All 400 in Security

Often used with HSTS

Tool Sites with both vs all new sites Bar
Vercel 787,980 2.1x

Tools that turn up far more often on HSTS sites than on new sites in general, and how many times as common each one is there.

Recently launched products built on HSTS

Notes

  1. These figures cover websites that went live since April 2026, not the web as a whole.
  2. Country comes from what each site says about itself, such as a company registration, legal terms or a phone number, not just its domain ending. Too few sites state their country plainly for the usual count, so this one also counts single signals: a country domain ending, a phone number (for North America, its area code), a location the site declares in its own page metadata, or a country-specific vendor stack and the page language where they agree and nothing contradicts them. Read these as likely rather than certain.
  3. Green hosting is the share whose web host The Green Web Foundation lists as running on green energy, among sites checked since 1 April 2026, against the same share for every new site we checked over that time. Data from The Green Web Foundation.

How this page is made

FirstSited looks at each new website near the day it goes live and records what it was built with. We do not go back later, so these figures describe what sites launch with, not what they run today. A site counts towards HSTS when we detect HSTS on it at that look.

Every share on this page is a proportion of the new sites we were tracking at the time. Sites we found across the wider web count towards the figures, but only product launches are listed by name. How we detect technologies · How we find new sites

Something not look right? If a technology shown here is wrong or out of date, email [email protected] and we'll review it.