{"id":1028,"date":"2018-09-05T11:22:34","date_gmt":"2018-09-05T11:22:34","guid":{"rendered":"https:\/\/www.sslrenewals.com\/blog\/?p=1028"},"modified":"2021-11-25T08:33:55","modified_gmt":"2021-11-25T08:33:55","slug":"half-of-the-alexa-top-million-websites-now-use-https","status":"publish","type":"post","link":"https:\/\/sslrenewals.com\/blog\/half-of-the-alexa-top-million-websites-now-use-https","title":{"rendered":"Half of the Alexa Top Million Websites now use HTTPS"},"content":{"rendered":"\n

The internet is making strides towards universal encryption<\/h2>\n\n\n\n

51.8% of the Alexa Top Million websites now use SSL\/TLS and are being served via HTTPS. This is fantastic news for the proliferation of encryption, but there is still a long way left to go. The Alexa top million actually isn\u2019t even a thing anymore. Amazon, which keeps the Alexa top website lists, discontinued putting out information for the top million months ago, but an enterprising group of researchers has kept it alive and continue to pull actionable information from it.<\/p>\n\n\n\n

Scott Helme has to publish Alexa top million information for seven months, he published his latest findings at the end of August and they are promising to say the least. Over half of the top million websites are now making secure connections.<\/p>\n\n\n\n

As late as January of this year adoption was still below 40%. But a few things have happened since then to push more websites towards HTTPS. The biggest, obviously, is Google\u2019s decision to mandate SSL<\/a>. Starting in July, all websites that were still being served over HTTP started getting penalized with browser warnings.<\/p>\n\n\n\n

\"HTTPS<\/figure><\/div>\n\n\n\n

Obviously, most people heed browser warnings, which means SSL<\/a> is now basically a requirement. And websites have responded, migrating to HTTPS en masse.<\/p>\n\n\n\n

HTTPS adoption wasn\u2019t the only thing on the rise, either. Helme also found that there has been a 40% increase in Content Security Policy (CSP) headers and a 23% increase in the use of HTTP Strict Transport Security (HSTS) headers, too.<\/p>\n\n\n\n

The only metric that appears to be dropping off is key pinning, which has been largely dismissed by the infosec community as unnecessarily dangerous.<\/p>\n\n\n\n

Some other interesting notes from Helme\u2019s research:<\/p>\n\n\n\n