Websites Powered by HSTS
12,285,411 websites tracked using HSTS (Security) · www.rfc-editor.org
HTTP Strict Transport Security (HSTS) is a security policy, sent via the Strict-Transport-Security response header, that tells browsers to only connect to a site over HTTPS. It protects against protocol-downgrade and cookie-hijacking attacks and is a common baseline security measure.
Usage trend
2M
4M
6M
Sep 2022
Aug 2023
Aug 2024
Jul 2025
Jun 2026
Domains observed using HSTS in each month's HTTP Archive crawl,
Sep 2022 to Jun 2026 · peak 4,580,056 in Jun 2026. The tracked total above also
counts sites not re-crawled recently.
Core Web Vitals
LCP 1.7 s
INP 75 ms
CLS 0
TTFB 700 ms
Median site among 4,153,020 HSTS sites with Chrome UX data, p75 values, Jun 2026.
Top countries
United States
1,467,206
United Kingdom
450,618
Germany
441,210
India
429,462
France
366,415
Canada
324,872
Brazil
303,175
Italy
243,977
Sites using HSTS by audience country, Chrome UX Report.
Top sites by authority
9+
76% · 284 of 372 sites
8+
77% · 5,894 of 7,677 sites
7+
66% · 30,000 of 45,712 sites
6+
58% · 64,348 of 110,136 sites
5+
49% · 119,742 of 246,751 sites
The share of the web's most authoritative domains, by Open Page Rank tier, seen running HSTS in recent crawls. Only 372 domains worldwide score 9 or higher.
Websites using HSTS
| # | Domain | Open Page RankOPR | Est. monthly visits (US)Visits (US) | Keywords | First seen |
|---|---|---|---|---|---|
| 401 | aepd.es | 8.91/10 | 810 | 2,021 | Sep 2022 |
| 402 | zdnet.com | 8.91/10 | 656,900 | 705,745 | Sep 2022 |
| 403 | walmart.com | 8.91/10 | 78,582,300 | 16,234,360 | Sep 2022 |
| 404 | techtarget.com | 8.91/10 | 2,092,900 | 338,991 | Aug 2023 |
| 405 | huffpost.com | 8.91/10 | 931,000 | 747,568 | Sep 2022 |
| 406 | gallup.com | 8.91/10 | 126,500 | 36,270 | Sep 2022 |
| 407 | kickstarter.com | 8.91/10 | 402,200 | 179,276 | Sep 2022 |
| 408 | nypost.com | 8.91/10 | 5,095,400 | 2,159,056 | Sep 2022 |
| 409 | amazon.ca | 8.91/10 | 423,500 | 470,452 | Sep 2022 |
| 410 | shop-pro.jp | 8.91/10 | 17 | 9 | Sep 2022 |
| 411 | cisa.gov | 8.91/10 | 448,500 | 84,432 | Sep 2022 |
| 412 | pnas.org | 8.91/10 | 398,700 | 240,127 | Sep 2022 |
| 413 | ok.ru | 8.90/10 | 11,600 | 6,573 | Jun 2023 |
| 414 | automattic.com | 8.90/10 | 7,300 | 4,992 | Sep 2022 |
| 415 | webflow.com | 8.90/10 | 149,800 | 61,334 | Sep 2022 |
| 416 | zoho.com | 8.90/10 | 564,300 | 147,943 | Sep 2022 |
| 417 | newsweek.com | 8.90/10 | 5,153,000 | 1,681,137 | Sep 2022 |
| 418 | newyorker.com | 8.90/10 | 2,145,200 | 662,959 | Sep 2022 |
| 419 | www.gov.pl | 8.90/10 | 58,600 | 23,403 | Sep 2022 |
| 420 | nationalgeographic.com | 8.90/10 | 3,598,800 | 677,296 | Sep 2022 |
| 421 | nyu.edu | 8.90/10 | 674,000 | 142,032 | Sep 2022 |
| 422 | nyc.gov | 8.90/10 | 3,942,300 | 913,688 | Sep 2022 |
| 423 | dot.gov | 8.90/10 | - | - | Sep 2022 |
| 424 | enable-javascript.com | 8.89/10 | 5,100 | 4,820 | Aug 2023 |
| 425 | figma.com | 8.89/10 | 1,963,000 | 300,098 | Sep 2022 |
| 426 | opensource.org | 8.89/10 | 22,200 | 6,030 | Sep 2022 |
| 427 | huawei.com | 8.89/10 | 52,700 | 5,653 | Sep 2022 |
| 428 | akismet.com | 8.89/10 | 1,600 | 724 | Sep 2022 |
| 429 | nvidia.com | 8.89/10 | 1,845,000 | 409,683 | Sep 2022 |
| 430 | entrepreneur.com | 8.89/10 | 278,400 | 158,366 | Sep 2022 |
| 431 | vice.com | 8.89/10 | 1,255,700 | 507,572 | Sep 2022 |
| 432 | imf.org | 8.89/10 | 704,000 | 210,345 | Sep 2022 |
| 433 | eventbrite.co.uk | 8.89/10 | 5,500 | 12,423 | Sep 2022 |
| 434 | hbs.edu | 8.89/10 | 272,000 | 59,628 | Sep 2022 |
| 435 | boe.es | 8.89/10 | 21,700 | 67,637 | Sep 2024 |
| 436 | usc.edu | 8.89/10 | 361,000 | 14,987 | Sep 2022 |
| 437 | php.net | 8.88/10 | 208,800 | 62,347 | Sep 2022 |
| 438 | iheart.com | 8.88/10 | 1,899,600 | 677,344 | Sep 2022 |
| 439 | termly.io | 8.88/10 | 155,200 | 8,893 | Sep 2022 |
| 440 | moodle.org | 8.88/10 | 20,900 | 11,079 | Sep 2022 |
| 441 | zapier.com | 8.88/10 | 1,224,700 | 222,443 | Sep 2022 |
| 442 | debian.org | 8.88/10 | 39,200 | 16,492 | Sep 2022 |
| 443 | dg-datenschutz.de | 8.88/10 | 1 | 2 | Sep 2022 |
| 444 | airbnb.com | 8.88/10 | 5,582,500 | 1,329,744 | Sep 2022 |
| 445 | box.com | 8.88/10 | 275,900 | 24,416 | Sep 2022 |
| 446 | jimdofree.com | 8.88/10 | - | - | Sep 2022 |
| 447 | chatgpt.com | 8.88/10 | 2,462,300 | 107,528 | Sep 2023 |
| 448 | semrush.com | 8.88/10 | 401,800 | 64,435 | Sep 2022 |
| 449 | hilton.com | 8.88/10 | 11,989,800 | 1,201,334 | Sep 2022 |
| 450 | jimdo.com | 8.88/10 | 5,000 | 3,125 | Sep 2022 |
| 451 | ssrn.com | 8.88/10 | 19,900 | 24,188 | Sep 2022 |
| 452 | scientificamerican.com | 8.88/10 | 976,600 | 345,261 | Sep 2022 |
| 453 | heise.de | 8.88/10 | 24,700 | 39,836 | Sep 2022 |
| 454 | duke.edu | 8.88/10 | 193,100 | 821 | Sep 2022 |
| 455 | economie.gouv.fr | 8.88/10 | 15,700 | 10,150 | Sep 2022 |
| 456 | samhsa.gov | 8.88/10 | 1,879,200 | 123,433 | Sep 2022 |
| 457 | fema.gov | 8.88/10 | 633,000 | 225,330 | Sep 2022 |
| 458 | osha.gov | 8.88/10 | 1,149,300 | 474,378 | Sep 2022 |
| 459 | onetrust.com | 8.87/10 | 18,400 | 9,662 | Sep 2022 |
| 460 | azurewebsites.net | 8.87/10 | - | - | Sep 2022 |
| 461 | youku.com | 8.87/10 | 140 | 80 | Sep 2022 |
| 462 | appspot.com | 8.87/10 | - | - | Sep 2022 |
| 463 | googleblog.com | 8.87/10 | - | - | Sep 2022 |
| 464 | disqus.com | 8.87/10 | 7,100 | 1,014 | Sep 2022 |
| 465 | accenture.com | 8.87/10 | 138,800 | 76,754 | Sep 2022 |
| 466 | fandom.com | 8.87/10 | 96,300 | 43,935 | Sep 2022 |
| 467 | claude.ai | 8.87/10 | 361,300 | 15,433 | Mar 2023 |
| 468 | barnesandnoble.com | 8.87/10 | 5,433,800 | 1,229,936 | Sep 2022 |
| 469 | variety.com | 8.87/10 | 5,363,900 | 1,380,933 | Sep 2022 |
| 470 | mashable.com | 8.87/10 | 1,958,400 | 901,029 | Sep 2022 |
| 471 | jamanetwork.com | 8.87/10 | 888,800 | 459,729 | Sep 2022 |
| 472 | bmj.com | 8.87/10 | 191,800 | 113,110 | Sep 2022 |
| 473 | cam.ac.uk | 8.87/10 | 208,200 | 35,354 | Sep 2022 |
| 474 | sueddeutsche.de | 8.87/10 | 11,300 | 26,267 | Sep 2022 |
| 475 | nta.go.jp | 8.87/10 | 560 | 1,002 | Sep 2022 |
| 476 | rijksoverheid.nl | 8.87/10 | 7,900 | 3,921 | Sep 2022 |
| 477 | medlineplus.gov | 8.87/10 | 19,077,400 | 1,663,537 | Sep 2022 |
| 478 | jsfiddle.net | 8.86/10 | 8,900 | 7,602 | Sep 2022 |
| 479 | myportfolio.com | 8.86/10 | - | - | Sep 2022 |
| 480 | optimizely.com | 8.86/10 | 149,400 | 9,101 | Sep 2022 |
| 481 | max.ru | 8.86/10 | 31 | 11 | Aug 2025 |
| 482 | site.com | 8.86/10 | - | 1 | Sep 2022 |
| 483 | us.com | 8.86/10 | 32 | 9 | Sep 2022 |
| 484 | nami.org | 8.86/10 | 626,800 | 117,511 | Apr 2023 |
| 485 | intel.com | 8.86/10 | 1,129,900 | 230,322 | Sep 2022 |
| 486 | matterport.com | 8.86/10 | 15,700 | 8,593 | Sep 2022 |
| 487 | trello.com | 8.86/10 | 78,700 | 52,187 | Sep 2022 |
| 488 | libsyn.com | 8.86/10 | 3,900 | 1,232 | Sep 2022 |
| 489 | eff.org | 8.86/10 | 73,200 | 30,008 | Sep 2022 |
| 490 | axios.com | 8.86/10 | 1,395,400 | 616,835 | Sep 2022 |
| 491 | huggingface.co | 8.86/10 | 265,400 | 188,064 | Sep 2022 |
| 492 | google.pl | 8.86/10 | 120 | 290 | Sep 2022 |
| 493 | coe.int | 8.86/10 | 138,700 | 44,475 | Sep 2022 |
| 494 | shorturl.at | 8.86/10 | 61,100 | 1,340 | Jun 2025 |
| 495 | purdue.edu | 8.86/10 | 744,800 | 169,159 | Sep 2022 |
| 496 | northwestern.edu | 8.86/10 | 193,400 | 45,922 | Sep 2022 |
| 497 | uspto.gov | 8.86/10 | 808,300 | 111,978 | Sep 2022 |
| 498 | defense.gov | 8.86/10 | 23,400 | 8,184 | Sep 2022 |
| 499 | govinfo.gov | 8.86/10 | 535,400 | 309,455 | Sep 2022 |
| 500 | cancer.gov | 8.86/10 | 4,680,800 | 325,886 | Sep 2022 |
Open Page Rank is the domain's authority score (0 to 10, from the open web link graph); the list is ordered by it and covers sites seen in recent crawls. Visits and keywords are estimated US organic search figures.
Download top 10,000 as CSV (zip) →
Compare HSTS
- HSTS vs reCAPTCHA
- HSTS vs Cloudflare Bot Management
- HSTS vs Really Simple SSL & Security
- HSTS vs DDoS-Guard
- HSTS vs Cloudflare Turnstile