The State of SSL/TLS
We used GeoTrust SSL Monitor to analyze the security of the world's 1,000,000 most-visited websites.
An average score masks a divided web
The average SSL Monitor score for the top million sites is 83 (Fair).
This average grade hides a split - many sites with excellent security and many with rather poor security. Most responding websites now negotiate modern TLS; 34.9% still accept TLS 1.0 (often a deliberate choice to reach older devices). On other measures, though, many websites lag well behind best practices. For example, only 61.3% offer post-quantum key agreement.
Denominator: deep-scanned websites · n = 973,441
View as table
| Measure | Value | Basis |
|---|---|---|
| TLS score | 82.6 | 973,441 deep-scanned websites |
| TLS score excluding Cloudflare | 82.4 | 553,890 deep-scanned websites |
When you visit these websites
What will a visitor to these websites see? No HTTPS at all, a certificate that breaks, serious issues, secure, or fully secure (A+ with nothing to fix)?
View as table
| Category | Sites | Share |
|---|---|---|
| Fully secure | 513,594 | 51.4% |
| Secure | 72,733 | 7.3% |
| Secure with serious issues | 348,865 | 34.9% |
| Certificate breaks for visitors | 46,421 | 4.6% |
| Website with no HTTPS | 18,387 | 1.8% |
The top 1,000,000 websites, one square per group of sites
Sorted by outcome, then rank band. Squares are anonymous by design — hover for the outcome and rank band, never the site.
One square ≈ 1,000 sites (1,000,000 in view); categories with fewer sites are shown as a single square.
Denominator: websites · n = 1,000,000
View as table
| Category | Sites | Share |
|---|---|---|
| Fully secure | 513,594 | 51.4% |
| Secure | 72,733 | 7.3% |
| Secure with serious issues | 348,865 | 34.9% |
| Certificate breaks for visitors | 46,421 | 4.6% |
| Website with no HTTPS | 18,387 | 1.8% |
What this month's data shows
Still accept TLS 1.0
339,634 of 973,441 deep-scanned websites — deprecated since 2021.
Denominator: deep-scanned websites · n = 973,441
View as table
| Measure | Share | Sites | n |
|---|---|---|---|
| TLS 1.0 offering | 34.9% | 339,634 | 973,441 |
Post-quantum key agreement
596,914 of 973,441 deep-scanned websites offer a hybrid post-quantum key exchange.
Denominator: deep-scanned websites · n = 973,441
Without Cloudflare-fronted websites the share is 33.6%.
View as table
| Measure | Share | Sites | n |
|---|---|---|---|
| Post-quantum key exchange | 61.3% | 596,914 | 973,441 |
Certificate lifetimes
How many websites are already using shorter certificates?
Maximum lifetime: 200 days (Mar 2026), 100 (Mar 2027), 47 (Mar 2029).
Denominator: deep-scanned websites · n = 973,441
View as table
| Bucket | Sites | Share |
|---|---|---|
| ≤ 47 days | 2,499 | 0.3% |
| 48–100 days | 754,840 | 77.5% |
| 101–200 days | 128,665 | 13.2% |
| 201–398 days | 83,317 | 8.6% |
| > 398 days | 4,120 | 0.4% |
HTTPS enforcement
HSTS, HTTP→HTTPS redirects, and the preload directive.
Denominator: websites · n = 1,000,000
View as table
| Measure | Share | Sites | n |
|---|---|---|---|
| HSTS adoption | 34.4% | 344,100 | 1,000,000 |
| HTTPS redirects | 78.6% | 785,700 | 1,000,000 |
| HSTS preload directive | 9.4% | 93,900 | 1,000,000 |
Score by industry: who's ahead of the web, who's behind
Mean SSL Monitor score among successfully graded websites.
Denominator: deep-scanned websites · n per cohort in the table
E-commerce & Retail leads at 86.7 pts; Other trails at 74.3 pts.
View as table
| Slice | Average score | vs benchmark | n |
|---|---|---|---|
| E-commerce & Retail | 86.7 pts | +4 pts | 151,466 |
| Healthcare | 86.2 pts | +3.5 pts | 42,642 |
| Travel & Local | 85.2 pts | +2.6 pts | 58,256 |
| Finance | 85.2 pts | +2.5 pts | 34,232 |
| News & Publishing | 84.2 pts | +1.6 pts | 34,542 |
| Telecom | 82.6 pts | ±0 pts | 7,186 |
| Education | 82.6 pts | −0.1 pts | 102,118 |
| Adult | 82.5 pts | −0.2 pts | 24,873 |
| Media & Social | 82.3 pts | −0.4 pts | 120,053 |
| Gaming & Gambling | 81.8 pts | −0.9 pts | 89,932 |
| Software & Internet | 81.1 pts | −1.6 pts | 221,156 |
| Government | 80 pts | −2.6 pts | 21,988 |
| Cloud & Infrastructure | 74.9 pts | −7.7 pts | 53,540 |
| Other | 74.3 pts | −8.3 pts | 11,457 |
Methodology
Everything below is pinned per run — the scanner image, testssl build, scoring algorithm, aggregator, ASN database, dotgov list, industry list and compliance rules — so any month can be recomputed from its raw data.
Not affected by the filter above.- PopulationThe top 1,000,000 websites from the Tranco list published for October 2026. The list is seeded beyond one million ranks and filled in rank order: 1,121,989 domains were crawled to reach 1,000,000 websites, and 121,989 were excluded from the report: domains that don't resolve, hosts that block our scanner, and hosts with no HTTP/HTTPS that are infrastructure.
- Outcome mappingEvery website is mapped to an outcome: no HTTPS response → Website with no HTTPS; untrusted or missing certificate → Certificate breaks; a HIGH/CRITICAL vulnerability prerequisite or a grade of B or below → Serious issues; A−/A → Secure; A+ → Fully secure.
- ScoringWebsites are rated using GeoTrust SSL Monitor's SSL/TLS security score, which incorporates 35+ factors into an overall score. Scoring factors include certificate trust; expiry; HTTPS configuration; and protocol, cipher and vulnerability checks.
- Classified slicesIndustry/country/region/gov cohorts are created using several data sources, including the CISA .gov registry, domain TLD, the site's own contact details, and categorization by a language model.
- Generated2026-10-30T01:20:17.469Z
How we scan / opt out
The scanner runs the same way other established internet-measurement projects do: identified, published and polite.
- User-AgentEvery HTTP request identifies itself as
Mozilla/5.0 (compatible; StateOfSSL-Research/1.0; +https://www.geotrust.com/research/state-of-ssl), with ordinaryAcceptandAccept-Languageheaders. - Source addressesA fixed pool of Elastic IPs in a dedicated AWS account; each carries a reverse-DNS name matching
stateofssl-scanner-NN.sslviking.com, so a connection from the scanner can be attributed with a single PTR lookup. - What one scan isOne deep TLS handshake set per host per month (protocols, ciphers, certificate chain, key exchange, vulnerability prerequisites) plus two plain GETs — port 80 for the redirect chain and port 443 for the response headers. No login, no forms, no crawling beyond the landing page, no retries against hosts that challenge. A domain whose HTTPS does not answer is also tried at www.<domain>, and one that answers nothing at all is tried once more later in the same run before it is set aside.
- Opt outContact GeoTrust support (geotrust.com/support) with the domain and it joins the opt-out list, which the seeder applies before any shard is built — an opted-out domain is not contacted at all in later runs. Requests are handled within one business day.
Download the data behind this report
Not affected by the filter above.Download this month's data
Every number on these pages, as published: the aggregates file (75 measures with every cohort slice) and one CSV per measure. Files contain outcomes, shares and cohort labels only — never a domain name.
- aggregates.jsonAll measures, slices, compliance and month-over-month changes for run 2026-10
- outcome.csvHTTPS outcome — Observed HTTPS outcome across all websites; a website whose deep scan did not complete is counted as couldn't be graded.
- grade.csvTLS grade — Observed deep-scan TLS grade distribution.
- deepScanCoverage.csvDeep-scan coverage — Share of TLS responders whose deep scan (testssl) completed; the population every deep-scan measure describes.
- tls13.csvTLS 1.3 adoption — Share of deep-scanned websites supporting TLS 1.3.
- tls10.csvTLS 1.0 offering — Share of deep scans offering TLS 1.0.
- tls11.csvTLS 1.1 offering — Share of deep scans offering TLS 1.1.
- sslv3.csvSSLv3 offering — Share of deep scans offering SSLv3.
- pqc.csvPost-quantum key exchange — Share of deep-scanned websites offering a hybrid post-quantum key-exchange group.
- hsts.csvHSTS adoption — Share of websites sending an HSTS policy.
- hstsPreload.csvHSTS preload directive — Share of websites sending the HSTS preload directive.
- redirectHttps.csvHTTPS redirects — Share of websites whose HTTP entry point redirects to HTTPS.
- forwardSecrecy.csvForward secrecy — Share of deep-scanned websites with forward secrecy available.
- … and 63 more measures, listed in the table below.
License. Creative Commons Attribution 4.0 International (CC BY 4.0). Reuse, redistribute and build on the data with attribution.
Cite as. GeoTrust Research (2026). The State of SSL/TLS, October 2026 edition. https://www.geotrust.com/research/state-of-ssl/2026-10
Reproducibility. testssl 3.3dev · scoring tsshelpersjs@2.1.3 · aggregator 1.7.1 · Tranco list snapshot for 2026-10 archived with the run.
View as table
| Measure | Id | Shape | File |
|---|---|---|---|
| All aggregates | aggregates | json | https://www.geotrust.com/research/state-of-ssl/2026-10/data/aggregates.json |
| HTTPS outcome | outcome | composition | https://www.geotrust.com/research/state-of-ssl/2026-10/data/outcome.csv |
| TLS grade | grade | composition | https://www.geotrust.com/research/state-of-ssl/2026-10/data/grade.csv |
| Deep-scan coverage | deepScanCoverage | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/deepScanCoverage.csv |
| TLS 1.3 adoption | tls13 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/tls13.csv |
| TLS 1.0 offering | tls10 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/tls10.csv |
| TLS 1.1 offering | tls11 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/tls11.csv |
| SSLv3 offering | sslv3 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/sslv3.csv |
| Post-quantum key exchange | pqc | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/pqc.csv |
| HSTS adoption | hsts | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/hsts.csv |
| HSTS preload directive | hstsPreload | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/hstsPreload.csv |
| HTTPS redirects | redirectHttps | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/redirectHttps.csv |
| Forward secrecy | forwardSecrecy | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/forwardSecrecy.csv |
| HTTP/2 adoption | http2 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/http2.csv |
| HTTP/3 advertisement | http3 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/http3.csv |
| Encrypted Client Hello | ech | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/ech.csv |
| IPv6 DNS reachability | ipv6 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/ipv6.csv |
| CAA adoption | caa | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/caa.csv |
| OCSP stapling | ocspStapling | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/ocspStapling.csv |
| Certificate lifetime | certLifetime | distribution | https://www.geotrust.com/research/state-of-ssl/2026-10/data/certLifetime.csv |
| Certificate issuer | issuer | composition | https://www.geotrust.com/research/state-of-ssl/2026-10/data/issuer.csv |
| Certificate key algorithm | keyAlgorithm | composition | https://www.geotrust.com/research/state-of-ssl/2026-10/data/keyAlgorithm.csv |
| Certificate validation type | validationType | composition | https://www.geotrust.com/research/state-of-ssl/2026-10/data/validationType.csv |
| Certificate SAN count | sanCount | distribution | https://www.geotrust.com/research/state-of-ssl/2026-10/data/sanCount.csv |
| TLS score | score | score | https://www.geotrust.com/research/state-of-ssl/2026-10/data/score.csv |
| CDN-fronted | cdnFronted | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/cdnFronted.csv |
| Edge provider | edgeProvider | composition | https://www.geotrust.com/research/state-of-ssl/2026-10/data/edgeProvider.csv |
| Bot-management challenge | challenged | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/challenged.csv |
| BEAST prerequisite | vulnPrereq.BEAST | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.BEAST.csv |
| BEAST serious prerequisite | vulnPrereq.BEAST.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.BEAST.serious.csv |
| LUCKY13 prerequisite | vulnPrereq.LUCKY13 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.LUCKY13.csv |
| LUCKY13 serious prerequisite | vulnPrereq.LUCKY13.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.LUCKY13.serious.csv |
| SWEET32 prerequisite | vulnPrereq.SWEET32 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.SWEET32.csv |
| SWEET32 serious prerequisite | vulnPrereq.SWEET32.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.SWEET32.serious.csv |
| BREACH prerequisite | vulnPrereq.BREACH | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.BREACH.csv |
| BREACH serious prerequisite | vulnPrereq.BREACH.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.BREACH.serious.csv |
| POODLE_SSL prerequisite | vulnPrereq.POODLE_SSL | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.POODLE_SSL.csv |
| POODLE_SSL serious prerequisite | vulnPrereq.POODLE_SSL.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.POODLE_SSL.serious.csv |
| ROBOT prerequisite | vulnPrereq.ROBOT | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.ROBOT.csv |
| ROBOT serious prerequisite | vulnPrereq.ROBOT.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.ROBOT.serious.csv |
| heartbleed prerequisite | vulnPrereq.heartbleed | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.heartbleed.csv |
| heartbleed serious prerequisite | vulnPrereq.heartbleed.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.heartbleed.serious.csv |
| CCS prerequisite | vulnPrereq.CCS | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.CCS.csv |
| CCS serious prerequisite | vulnPrereq.CCS.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.CCS.serious.csv |
| ticketbleed prerequisite | vulnPrereq.ticketbleed | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.ticketbleed.csv |
| ticketbleed serious prerequisite | vulnPrereq.ticketbleed.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.ticketbleed.serious.csv |
| CRIME prerequisite | vulnPrereq.CRIME | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.CRIME.csv |
| CRIME serious prerequisite | vulnPrereq.CRIME.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.CRIME.serious.csv |
| FREAK prerequisite | vulnPrereq.FREAK | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.FREAK.csv |
| FREAK serious prerequisite | vulnPrereq.FREAK.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.FREAK.serious.csv |
| DROWN prerequisite | vulnPrereq.DROWN | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.DROWN.csv |
| DROWN serious prerequisite | vulnPrereq.DROWN.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.DROWN.serious.csv |
| LOGJAM prerequisite | vulnPrereq.LOGJAM | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.LOGJAM.csv |
| LOGJAM serious prerequisite | vulnPrereq.LOGJAM.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.LOGJAM.serious.csv |
| RC4 prerequisite | vulnPrereq.RC4 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.RC4.csv |
| RC4 serious prerequisite | vulnPrereq.RC4.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.RC4.serious.csv |
| secure_renego prerequisite | vulnPrereq.secure_renego | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.secure_renego.csv |
| secure_renego serious prerequisite | vulnPrereq.secure_renego.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.secure_renego.serious.csv |
| secure_client_renego prerequisite | vulnPrereq.secure_client_renego | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.secure_client_renego.csv |
| secure_client_renego serious prerequisite | vulnPrereq.secure_client_renego.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.secure_client_renego.serious.csv |
| winshock prerequisite | vulnPrereq.winshock | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.winshock.csv |
| winshock serious prerequisite | vulnPrereq.winshock.serious | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/vulnPrereq.winshock.serious.csv |
| SSLv2 offering | legacy.sslv2 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/legacy.sslv2.csv |
| SSLv3 offering | legacy.sslv3 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/legacy.sslv3.csv |
| TLS 1.0 offering | legacy.tls10 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/legacy.tls10.csv |
| TLS 1.1 offering | legacy.tls11 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/legacy.tls11.csv |
| TLS 1.2 offering | legacy.tls12 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/legacy.tls12.csv |
| TLS 1.3 offering | legacy.tls13 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/legacy.tls13.csv |
| NULL cipher family | cipher.null | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/cipher.null.csv |
| anonymous cipher family | cipher.anon | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/cipher.anon.csv |
| EXPORT cipher family | cipher.export | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/cipher.export.csv |
| LOW cipher family | cipher.low | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/cipher.low.csv |
| 3DES cipher family | cipher.tripleDes | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/cipher.tripleDes.csv |
| RC4 cipher family | cipher.rc4 | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/cipher.rc4.csv |
| obsoleted CBC cipher family | cipher.obsoletedCbc | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/cipher.obsoletedCbc.csv |
| strong forward-secrecy cipher family | cipher.strongFs | proportion | https://www.geotrust.com/research/state-of-ssl/2026-10/data/cipher.strongFs.csv |