HSTS and preload in 2026: who forces the browser onto HTTPS only

The Strict-Transport-Security header tells a browser to reach this site over HTTPS only — and to remember that for the duration in max-age. It closes a window that survives even a complete move to HTTPS: the very first request, typed by hand or arriving via an old link, still goes out over HTTP and can be intercepted before the redirect fires.

The includeSubDomains directive extends the rule to every subdomain. Without it a forgotten old.example.com stays a hole in an otherwise closed defence.

preload closes the first request too: the domain goes into a list baked into the browser itself, and HTTPS applies before any contact is made. The price is irreversibility — removal is possible, but it propagates through browser releases over months.

On 27 August 2026 we requested 150 hosts per zone over HTTP — drawn from those users had brought to our tools — followed the redirects, and checked whether the final response carried Strict-Transport-Security. The method deliberately mirrors the one Scott Helme uses in his annual top-1M survey.

The includeSubDomains and preload shares are of the sites that send the header, not of all sites in the zone.

Sampling caveats. These are domains somebody chose to check, not a random slice of a zone, so the .ru share cannot stand in for "the Russian web"; comparing zones is sound, since they were collected identically. Non-responders are excluded from the denominator: 31 each for .ru and .com, 38 for .org, 58 for .net. The high .net attrition comes from its composition — service names like *.ip-ns.net, which host no site at all — so treat that row with more caution than the rest.

An indirect check on the method: our .com sample shows 48% carrying includeSubDomains, while Scott Helme measured 49.8% across 819,002 top-1M sites. The figures agree on a sample five thousand times smaller — that proves nothing on its own, but it says the measurement is not grossly skewed.

The list is not an abstraction but a file in the Chromium source, and it can be counted. On 27 August 2026 transport_security_state_static.json held 94,628 entries; the file was last modified on 28 July 2026. Of those, 94,378 carry include_subdomains.

Entries arrived on different grounds: bulk one-year inclusion 84,352; public-suffix owner request 4,954; bulk 18-week inclusion 4,552; individual submissions 394.

An important subtlety: an entry is not a site. Nearly all carry includeSubDomains, covering an unknown number of subdomains, and five thousand entries apply to whole domain zones. The real number of protected hosts is substantially larger than 94,628 and has been measured by nobody.

Two things are worth keeping apart here. In Helme’s survey 29.2% of HSTS sites send the preload directive, but only 21% (53,019 sites) satisfy the list’s requirements. Sending the directive and being in the list are not the same thing: a submission has to be made, and it is checked.

On 13 June 2026 Scott Helme crawled the Tranco Top 1 Million; 819,002 sites responded, and 252,846 of them sent an HSTS header. He publishes no percentage — against the responding count that is 30.9%, and that is our arithmetic on his figures, not his publication. From the same survey: 69.2% set a max-age of at least a year.

A second independent measurement comes from HTTP Archive: 36% of mobile pages send HSTS. That is a July 2025 crawl published in January 2026; no 2026 edition of the Web Almanac exists, and presenting the figure as current would be wrong.

These numbers must not be added together: Helme counts sites, HTTP Archive counts pages, we count hosts from our own sample. Each is correct within its own boundary.

On max-age our divergence is notable: 88% of HSTS senders in .ru and 80% in .com set at least a year, against Helme’s 69.2%. Sample size is the likelier explanation than a real difference.

This is the most interesting part of the measurement. We measured three protections in succession, and the picture for .ru came out different each time:

Where the setting is made on your own server, .ru trails moderately. Where it needs support from the registrar, it trails by an order of magnitude. That is precisely the difference produced not by an owner’s awareness but by whether a field exists in somebody else’s panel: a Russian administrator knows about HSTS and about CAA to roughly the same degree, but can only switch on the first.

The practical conclusion: if you are choosing where to spend an hour, HSTS is something you can set yourself right now — whereas DNSSEC and CAA support is worth checking with a registrar before you move a domain to them.

1. Check whether your site sends the header. It shows up in the response header check alongside the rest of your defences.
2. Make sure HTTPS works everywhere first — subdomains included. HSTS with includeSubDomains on a site where some subdomains still run over HTTP will make them unreachable.
3. Start with a short max-age — a day, say. Confirm nothing broke, and only then raise it to a year.
4. Think about preload separately. It is the one setting that is hard to undo: removal from the list propagates through browser releases over months. Submit once HTTPS across every subdomain has stopped raising questions, not on the same day.