Meets the TLS requirements of U.S. federal HTTPS policy: requirements met

OMB Memorandum M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services (2015), https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-13.pdf; CISA Binding Operational Directive 18-01, Enhance Email and Web Security (2017), https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security — conformance of observable TLS configuration to the standard's technical requirements. Applicable sites only; a requirement the scan cannot observe is excluded from its denominator.

All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% All requirements met: 5.5% 5.5%All requirements met54,427 of 998,668 applicable sites · all ranks
HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% HTTPS is enforced: 78.7% 78.7%HTTPS is enforcedOMB Memorandum M-15-13 · n=998,668
HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% HSTS max-age is at least one year: 22.8% 22.8%HSTS max-age is at least one yearCISA Binding Operational Directive 18-01 · n=998,668
HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% HSTS preload directive is present: 9.4% 9.4%HSTS preload directive is presentCISA Binding Operational Directive 18-01 · n=998,668
SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% SSLv2 is disabled: 100% 100%SSLv2 is disabledOMB Memorandum M-15-13 · n=998,668
SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% SSLv3 is disabled: 99.6% 99.6%SSLv3 is disabledOMB Memorandum M-15-13 · n=998,668
TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% TLS 1.0 is disabled: 66% 66%TLS 1.0 is disabledCISA Binding Operational Directive 18-01 · n=998,668
TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% TLS 1.1 is disabled: 64.5% 64.5%TLS 1.1 is disabledCISA Binding Operational Directive 18-01 · n=998,668
RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% RC4 cipher suites are disabled: 99.1% 99.1%RC4 cipher suites are disabledOMB Memorandum M-15-13 · n=998,668
3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 3DES cipher suites are disabled: 89.7% 89.7%3DES cipher suites are disabledCISA Binding Operational Directive 18-01 · n=998,668
Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% Certificate is publicly trusted: 93.6% 93.6%Certificate is publicly trustedOMB Memorandum M-15-13 · n=998,668

Denominator: applicable sites (requirements the scan cannot observe are excluded) · n = 998,668

Most-failed requirement in all ranks: HSTS preload directive is present (CISA Binding Operational Directive 18-01).

View as table
RequirementCitationPass sharen
All requirementsOMB Memorandum M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services (2015), https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-13.pdf; CISA Binding Operational Directive 18-01, Enhance Email and Web Security (2017), https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security5.5%998,668
HTTPS is enforcedOMB Memorandum M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services (2015), https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-13.pdf78.7%998,668
HSTS max-age is at least one yearCISA Binding Operational Directive 18-01, Enhance Email and Web Security (2017), https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security22.8%998,668
HSTS preload directive is presentCISA Binding Operational Directive 18-01, Enhance Email and Web Security (2017), https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security9.4%998,668
SSLv2 is disabledOMB Memorandum M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services (2015), https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-13.pdf100%998,668
SSLv3 is disabledOMB Memorandum M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services (2015), https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-13.pdf99.6%998,668
TLS 1.0 is disabledCISA Binding Operational Directive 18-01, Enhance Email and Web Security (2017), https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security66%998,668
TLS 1.1 is disabledCISA Binding Operational Directive 18-01, Enhance Email and Web Security (2017), https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security64.5%998,668
RC4 cipher suites are disabledOMB Memorandum M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services (2015), https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-13.pdf99.1%998,668
3DES cipher suites are disabledCISA Binding Operational Directive 18-01, Enhance Email and Web Security (2017), https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security89.7%998,668
Certificate is publicly trustedOMB Memorandum M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services (2015), https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-13.pdf93.6%998,668

Source: GeoTrust Research — The State of SSL/TLS, October 2026