Total Rows: 816748 

Security Headers Grades:
A 61,021
A+ 9,881
B 84,826
C 44,016
D 171,901
E 20,408
F 423,133
R 1,562

Sites using strict-transport-security:
250,741

Sites using content-security-policy:
173,943

Sites using content-security-policy-report-only:
14,316

Sites using x-webkit-csp:
564

Sites using x-content-security-policy:
2,308

Sites using public-key-pins:
511

Sites using public-key-pins-report-only:
15

Sites using x-content-type-options:
322,480

Sites using x-frame-options:
304,136

Sites using x-xss-protection:
158,958

Sites using x-download-options:
41,711

Sites using x-permitted-cross-domain-policies:
52,647

Sites using access-control-allow-origin:
49,873

Sites using referrer-policy:
225,957

Sites using feature-policy:
4,494

Sites using permissions-policy:
112,416

Sites using report-to:
282,468

Sites using nel:
279,389

Sites using security.txt:
10,466

Sites redirecting to HTTPS:
658,358

Sites using Let's Encrypt certificate:
300,877

Sites using EV Certificates:
3,817

Top 10 Server headers:
cloudflare 357,097
nginx 106,631
Apache 65,727
LiteSpeed 21,300
Microsoft-IIS/10.0 14,346
Vercel 9,045
AmazonS3 8,827
openresty 8,091
CloudFront 7,107
nginx/1.24.0 (Ubuntu) 5,581

Top 10 TLDs:
.com 358,881
.org 35,441
.net 34,668
.ru 27,431
.uk 24,681
.de 23,731
.nl 16,738
.br 14,885
.jp 11,077
.in 9,849

Top 10 Certificate Issuers:
C = US, O = Google Trust Services, CN = WE1 201,735
C = US, O = Let's Encrypt, CN = YE1 75,484
C = US, O = Let's Encrypt, CN = YR1 75,435
C = US, O = Let's Encrypt, CN = YR2 75,024
C = US, O = Let's Encrypt, CN = YE2 74,466
C = US, O = Amazon, CN = Amazon RSA 2048 M04 18,731
C = US, O = Amazon, CN = Amazon RSA 2048 M01 18,391
C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV R36 17,733
C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1 7,760
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust TLS RSA CA G1 7,471

TLS Protocol Versions:
TLSv1.3 584,826
TLSv1.2 64,293
TLSv1.0 70

Top 10 Cipher Suites:
TLS_AES_256_GCM_SHA384 492,819
TLS_AES_128_GCM_SHA256 89,423
ECDHE-RSA-AES256-GCM-SHA384 28,796
ECDHE-RSA-AES128-GCM-SHA256 20,552
ECDHE-ECDSA-CHACHA20-POLY1305 5,315
ECDHE-RSA-CHACHA20-POLY1305 2,900
ECDHE-ECDSA-AES256-GCM-SHA384 2,866
TLS_CHACHA20_POLY1305_SHA256 2,584
ECDHE-ECDSA-AES128-GCM-SHA256 1,862
ECDHE-RSA-AES256-SHA384 1,260

Top 10 PFS Key Exchange Params:
X25519MLKEM768 396,951
X25519, 253 bits 203,446
ECDH, prime256v1, 256 bits 31,781
ECDH, secp384r1, 384 bits 12,372
ECDH, secp521r1, 521 bits 3,929
<NULL> 1,903
DH, 3072 bits 175
DH, 2048 bits 135
DH, 4096 bits 28
X448, 448 bits 12

Top Key Sizes:
256 bit 347,911
2048 bit 256,450
4096 bit 31,576
384 bit 8,490
3072 bit 4,347
1024 bit 25
8192 bit 9
521 bit 6
2056 bit 2

Sites using CAA:
54,595

HTTP Protocol Versions:
http/2.0 580,926
http/1.1 235,155
http/1.0 646

Sites using cross-origin-opener-policy:
85,084

Sites using cross-origin-opener-policy-report-only:
720

Sites using cross-origin-embedder-policy:
52,164

Sites using cross-origin-embedder-policy-report-only:
763

Sites using cross-origin-resource-policy:
56,816

Sites using reporting-endpoints:
4,682

Sites using clear-site-data:
127

Sites using origin-agent-cluster:
52,009

Sites using document-policy:
1,382

Sites using document-policy-report-only:
3

Sites advertising HTTP/3 (Alt-Svc h3):
349,892

Sites using post-quantum key exchange:
396,951

Sites stapling OCSP:
36,087

Sites using DNSSEC:
79,946

Sites with IPv6 (AAAA):
337,997

Sites using DMARC:
423,786

DMARC policy distribution:
none 217,017
quarantine 108,138
reject 98,235

Sites using SPF:
556,769

Sites with a DNS HTTPS record:
269,213

Sites using ECH (DNS HTTPS ech=):
187,049

Sites setting cookies:
303,431

Sites with Secure cookies:
180,851

Sites with HttpOnly cookies:
214,964

Sites with SameSite cookies:
173,297

Cookie SameSite distribution:
none 77,243
lax 73,310
none,lax 6,679
strict 4,789
lax,none 4,626
strict,none 1,602
none,strict 1,456
strict,lax 1,181
lax,strict 956
strict,lax,none 955
none,strict,lax 172
none,lax,strict 102
lax,strict,none 93
strict,none,lax 84
lax,none,strict 49

Sites using __Host- cookie prefix:
993

Sites using __Secure- cookie prefix:
1,687

Sites using a wildcard certificate:
313,964

Sites with CT SCTs embedded in cert:
658,060

Certificate validity buckets:
<=6 days 3
7-47 days 1,743
48-90 days 519,407
91-200 days 87,176
201-398 days 49,989
399+ days 309

Certificate signature algorithms:
RSA-SHA256 296,543
ecdsa-with-SHA256 206,239
ecdsa-with-SHA384 154,739
RSA-SHA384 752
RSA-SHA512 331
ecdsa-with-SHA512 10
RSA-SHA1 10
RSA-MD5 2
RSA-SHA1-2 1

CORS: ACAO wildcard (*):
42,231

CORS: ACAO null:
69