Total Rows: 819880 

Security Headers Grades:
A 62,622
A+ 11,609
B 80,085
C 42,578
D 173,553
E 22,723
F 425,157
R 1,553

Sites using strict-transport-security:
258,946

Sites using content-security-policy:
179,394

Sites using content-security-policy-report-only:
13,433

Sites using x-webkit-csp:
627

Sites using x-content-security-policy:
3,170

Sites using public-key-pins:
581

Sites using public-key-pins-report-only:
16

Sites using x-content-type-options:
316,027

Sites using x-frame-options:
327,680

Sites using x-xss-protection:
165,952

Sites using x-download-options:
41,651

Sites using x-permitted-cross-domain-policies:
52,378

Sites using access-control-allow-origin:
50,103

Sites using referrer-policy:
231,587

Sites using feature-policy:
4,646

Sites using permissions-policy:
117,079

Sites using report-to:
284,969

Sites using nel:
281,617

Sites using security.txt:
10,012

Sites redirecting to HTTPS:
660,839

Sites using Let's Encrypt certificate:
282,708

Sites using EV Certificates:
4,015

Top 10 Server headers:
cloudflare 357,488
nginx 107,176
Apache 67,503
LiteSpeed 23,148
Microsoft-IIS/10.0 14,759
Vercel 8,475
AmazonS3 8,323
openresty 7,879
CloudFront 7,153
hcdn 5,549

Top 10 TLDs:
.com 364,730
.net 35,063
.org 34,714
.ru 27,571
.de 23,241
.uk 23,124
.nl 17,899
.br 14,149
.jp 11,132
.in 9,927

Top 10 Certificate Issuers:
C = US, O = Google Trust Services, CN = WE1 217,701
C = US, O = Let's Encrypt, CN = YR1 74,322
C = US, O = Let's Encrypt, CN = YR2 73,949
C = US, O = Let's Encrypt, CN = YE1 65,930
C = US, O = Let's Encrypt, CN = YE2 65,423
C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV R36 19,262
C = US, O = Amazon, CN = Amazon RSA 2048 M04 18,688
C = US, O = Amazon, CN = Amazon RSA 2048 M01 18,322
C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1 8,390
C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust TLS RSA CA G1 7,489

TLS Protocol Versions:
TLSv1.3 582,282
TLSv1.2 67,754
TLSv1.0 93

Top 10 Cipher Suites:
TLS_AES_256_GCM_SHA384 492,460
TLS_AES_128_GCM_SHA256 87,408
ECDHE-RSA-AES256-GCM-SHA384 30,213
ECDHE-RSA-AES128-GCM-SHA256 21,648
ECDHE-ECDSA-CHACHA20-POLY1305 5,909
ECDHE-RSA-CHACHA20-POLY1305 3,365
ECDHE-ECDSA-AES256-GCM-SHA384 2,771
TLS_CHACHA20_POLY1305_SHA256 2,414
ECDHE-ECDSA-AES128-GCM-SHA256 1,770
ECDHE-RSA-AES256-SHA384 1,309

Top 10 PFS Key Exchange Params:
X25519MLKEM768 382,221
X25519, 253 bits 214,622
ECDH, prime256v1, 256 bits 35,727
ECDH, secp384r1, 384 bits 12,914
ECDH, secp521r1, 521 bits 3,958
<NULL> 2,040
DH, 2048 bits 153
DH, 3072 bits 116
DH, 4096 bits 28
X448, 448 bits 15

Top Key Sizes:
256 bit 345,132
2048 bit 260,488
4096 bit 31,482
384 bit 8,470
3072 bit 4,116
1024 bit 34
8192 bit 12
2056 bit 4

Sites using CAA:
54,203

HTTP Protocol Versions:
http/2.0 580,024
http/1.1 239,182
http/1.0 640

Sites using cross-origin-opener-policy:
95,271

Sites using cross-origin-opener-policy-report-only:
1,534

Sites using cross-origin-embedder-policy:
63,249

Sites using cross-origin-embedder-policy-report-only:
1,553

Sites using cross-origin-resource-policy:
66,986

Sites using reporting-endpoints:
4,259

Sites using clear-site-data:
113

Sites using origin-agent-cluster:
62,301

Sites using document-policy:
1,424

Sites advertising HTTP/3 (Alt-Svc h3):
351,097

Sites using post-quantum key exchange:
382,221

Sites stapling OCSP:
50,291

Sites using DNSSEC:
75,687

Sites with IPv6 (AAAA):
338,282

Sites using DMARC:
413,583

DMARC policy distribution:
none 213,558
quarantine 104,111
reject 95,495

Sites using SPF:
552,014

Sites with a DNS HTTPS record:
271,063

Sites using ECH (DNS HTTPS ech=):
189,046

Sites setting cookies:
320,094

Sites with Secure cookies:
192,863

Sites with HttpOnly cookies:
226,764

Sites with SameSite cookies:
182,642

Cookie SameSite distribution:
lax 80,889
none 77,985
none,lax 5,916
lax,none 5,913
strict 4,957
strict,none 1,684
none,strict 1,659
strict,lax 1,159
strict,lax,none 1,068
lax,strict 933
none,strict,lax 153
lax,strict,none 95
none,lax,strict 94
strict,none,lax 88
lax,none,strict 49

Sites using __Host- cookie prefix:
879

Sites using __Secure- cookie prefix:
1,811

Sites using a wildcard certificate:
316,894

Sites with CT SCTs embedded in cert:
660,640

Certificate validity buckets:
7-47 days 1,572
48-90 days 517,373
91-200 days 70,280
201-398 days 71,650
399+ days 241

Certificate signature algorithms:
RSA-SHA256 300,945
ecdsa-with-SHA256 222,219
ecdsa-with-SHA384 137,069
RSA-SHA384 602
RSA-SHA512 256
RSA-SHA1 21
ecdsa-with-SHA512 2
RSA-SHA1-2 1
RSA-MD5 1

CORS: ACAO wildcard (*):
41,983

CORS: ACAO null:
77