Total Rows: 825473 

Security Headers Grades:
A 73,398
A+ 11,380
B 72,781
C 43,558
D 176,983
E 19,718
F 426,189
R 1,466

Sites using strict-transport-security:
267,329

Sites using content-security-policy:
191,417

Sites using content-security-policy-report-only:
14,263

Sites using x-webkit-csp:
605

Sites using x-content-security-policy:
2,517

Sites using public-key-pins:
530

Sites using public-key-pins-report-only:
15

Sites using x-content-type-options:
328,319

Sites using x-frame-options:
334,758

Sites using x-xss-protection:
166,029

Sites using x-download-options:
44,734

Sites using x-permitted-cross-domain-policies:
55,719

Sites using access-control-allow-origin:
49,968

Sites using referrer-policy:
231,766

Sites using feature-policy:
4,687

Sites using permissions-policy:
114,256

Sites using report-to:
292,614

Sites using nel:
289,246

Sites using security.txt:
10,106

Sites redirecting to HTTPS:
661,787

Sites using Let's Encrypt certificate:
273,356

Sites using EV Certificates:
3,924

Top 10 Server headers:
cloudflare 366,027
nginx 104,750
Apache 65,675
LiteSpeed 17,224
Microsoft-IIS/10.0 14,293
openresty/1.31.1.1 10,244
Vercel 8,595
AmazonS3 8,188
openresty 7,693
CloudFront 7,117

Top 10 TLDs:
.com 364,557
.net 35,012
.org 34,835
.ru 27,380
.uk 26,137
.de 23,484
.nl 17,821
.br 14,105
.it 12,670
.jp 11,145

Top 10 Certificate Issuers:
C = US, O = Google Trust Services, CN = WE1 231,165
C = US, O = Let's Encrypt, CN = YR1 71,517
C = US, O = Let's Encrypt, CN = YR2 70,566
C = US, O = Let's Encrypt, CN = YE1 65,632
C = US, O = Let's Encrypt, CN = YE2 65,029
C = US, O = Amazon, CN = Amazon RSA 2048 M04 18,461
C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV R36 18,439
C = US, O = Amazon, CN = Amazon RSA 2048 M01 18,305
C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1 8,148
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust TLS RSA CA G1 7,447

TLS Protocol Versions:
TLSv1.3 586,484
TLSv1.2 65,457
TLSv1.0 74

Top 10 Cipher Suites:
TLS_AES_256_GCM_SHA384 496,955
TLS_AES_128_GCM_SHA256 87,174
ECDHE-RSA-AES256-GCM-SHA384 28,289
ECDHE-RSA-AES128-GCM-SHA256 21,248
ECDHE-ECDSA-CHACHA20-POLY1305 5,700
ECDHE-RSA-CHACHA20-POLY1305 3,279
ECDHE-ECDSA-AES256-GCM-SHA384 2,723
TLS_CHACHA20_POLY1305_SHA256 2,355
ECDHE-ECDSA-AES128-GCM-SHA256 2,203
ECDHE-RSA-AES256-SHA384 1,280

Top 10 PFS Key Exchange Params:
X25519MLKEM768 395,732
X25519, 253 bits 204,918
ECDH, prime256v1, 256 bits 34,440
ECDH, secp384r1, 384 bits 12,315
ECDH, secp521r1, 521 bits 3,897
<NULL> 1,958
DH, 3072 bits 182
DH, 2048 bits 139
DH, 4096 bits 25
X448, 448 bits 12

Top Key Sizes:
256 bit 358,125
2048 bit 250,210
4096 bit 31,011
384 bit 8,159
3072 bit 4,095
1024 bit 36
8192 bit 6
2056 bit 3

Sites using CAA:
54,375

HTTP Protocol Versions:
http/2.0 584,540
http/1.1 240,252
http/1.0 653

Sites using cross-origin-opener-policy:
97,965

Sites using cross-origin-opener-policy-report-only:
923

Sites using cross-origin-embedder-policy:
58,281

Sites using cross-origin-embedder-policy-report-only:
951

Sites using cross-origin-resource-policy:
62,644

Sites using reporting-endpoints:
4,407

Sites using clear-site-data:
115

Sites using origin-agent-cluster:
58,103

Sites using document-policy:
1,409

Sites advertising HTTP/3 (Alt-Svc h3):
353,821

Sites using post-quantum key exchange:
395,732

Sites stapling OCSP:
36,644

Sites using DNSSEC:
76,362

Sites with IPv6 (AAAA):
344,956

Sites using DMARC:
421,412

DMARC policy distribution:
none 217,718
quarantine 106,285
reject 96,991

Sites using SPF:
557,961

Sites with a DNS HTTPS record:
275,789

Sites using ECH (DNS HTTPS ech=):
193,083

Sites setting cookies:
326,786

Sites with Secure cookies:
201,613

Sites with HttpOnly cookies:
237,536

Sites with SameSite cookies:
192,726

Cookie SameSite distribution:
lax 90,884
none 78,110
none,lax 7,089
lax,none 4,794
strict 4,785
strict,none 1,801
none,strict 1,616
strict,lax 1,165
strict,lax,none 1,028
lax,strict 926
none,strict,lax 148
lax,strict,none 114
none,lax,strict 111
strict,none,lax 83
lax,none,strict 72

Sites using __Host- cookie prefix:
880

Sites using __Secure- cookie prefix:
1,741

Sites using a wildcard certificate:
320,441

Sites with CT SCTs embedded in cert:
661,211

Certificate validity buckets:
<=6 days 1
7-47 days 1,646
48-90 days 521,301
91-200 days 76,098
201-398 days 62,515
399+ days 479

Certificate signature algorithms:
RSA-SHA256 289,862
ecdsa-with-SHA256 235,568
ecdsa-with-SHA384 135,688
RSA-SHA384 634
RSA-SHA512 265
RSA-SHA1 17
ecdsa-with-SHA512 3
RSA-MD5 2
RSA-SHA1-2 1

CORS: ACAO wildcard (*):
42,077

CORS: ACAO null:
73