HSTS Benchmark 2026: Dissemination of the Strict Transport Security Header
HSTS is not a classic content signal, but a clear sign of technical maturity: browsers should only retrieve the website encrypted.
HSTS is not a classic content signal, but a clear sign of technical maturity: browsers should only retrieve the website encrypted.
HSTS active: 49 % (Average of domain values) from 68,464 evaluable domain values in the selected segment. The number describes the sample examined, not all websites or all URLs of these domains.
The indicator records the HSTS header of the examined responses. It alone says nothing about a suitable runtime, subdomain coverage or the suitability for a preload list.
Especially for companies, shops, law firms, portals and login areas, the lack of HTTPS hardening is unnecessarily weak. The header is often set quickly, but is surprisingly often forgotten in everyday life.
In the audit, HSTS complements the SEO view with technical trust signals. If HTTPS exists but HSTS is missing, this is usually a concrete, well-delineated fix.
The benchmark alone does not yet say which measure should be implemented first. In the website audit, the value is combined with URL type, severity, priority and specific findings.
Compare your own domainsecurity_hsts is based on the response header Strict-Transport-Security. An indication of the same name in HTML does not replace this HTTP header.
The homepage and application area can be delivered via various servers or proxies. An existing header on the homepage does not occupy full coverage.
First, check whether all affected hosts are reliably reachable via HTTPS. includeSubDomains should fit this technical requirement.
The component is not a safety seal. Certificate, redirects, header value and the impact on subdomains must be assessed individually.
A benchmark is a benchmark, not an absolute truth. Important is the deviation to the own website and the question of whether the signal for the affected pages is business relevant.
The baseline takes numerical metrics from the latest stored crawl per domain into account, if this was successful. Missing values do not enter as 0. Segments are only calculated from five available domain values. The selection is not a random sample and not a representative market share.
The current sampler selects up to ten URLs from sitemap or internal links; successful retrievals are combined into a domain mean for each metric. Older data sets can be based on a single page. In the case of shares, the page shows the mean value of the domain values, in the case of ALT coverage their median. Not all URLs of a website are examined.
Canonicals are a quiet but important indexing signal: they help search engines merge variants of a page cleanly.
SnippetsMeta descriptions are not a direct ranking lever, but they do influence how convincing a page is in the search result.
Structured dataStructured data makes content more explicit: organization, website, breadcrumbs, articles, products or local company data become easier to read for machines.