TLS in 2026: what the checks actually show

Numbers here come from two places and are kept apart.

An independent survey, cited with its date and coverage. It runs against a list of the world’s most visited sites and does not describe the Russian web.

Our own checks. Between 20 March and 26 August 2026 our SSL checker ran 2,803 checks across 2,249 hosts. This is not a sample of the Russian web. Comparing zones inside the sample is sound; carrying the levels over to "all websites" is not.

Separately, on 27 August 2026, we ran two measurements: a component breakdown across 87 hosts graded B or C, and a protocol-version check across 113 hosts from the general sample.

Scott Helme’s Top 1 Million Analysis — The State of Crypto of 13 June 2026 covers 819,002 responding sites from the Tranco Top 1 Million:

The striking part is the zeros at the bottom: legacy protocol versions are extinct at the top of the web. Not one site of 819,000 supports TLS 1.1, and TLS 1.0 survives on a hundred and six.

The same report gives certificate authority shares — Let’s Encrypt 302,116, Google Trust Services 203,436, Amazon 37,690, DigiCert 34,961, Sectigo 29,006 — and validity: 77.4% issued for 48–90 days, the signature of ACME automation.

On 27 August 2026 we checked which protocol versions hosts from the general sample support — 80 per zone, of which 56 and 57 answered:

This deserves saying plainly, because it contradicts the common expectation. Not one host in either zone supports TLS 1.0 or 1.1. On this the Russian web is not behind — it is exactly level. If anything our .ru sample runs slightly ahead on TLS 1.3, 83.9% against 80.7%, though a sample this size does not establish that.

Note the gap with the top million too: 70.4% there against over 80% in both of our zones. That is expected — people bring domains here when they are already working on them, while the Tranco list includes long-abandoned sites.

Latest verdict per host across all 2,249:

Nearly one checked host in seven never completes a TLS connection at all.

Outright bad configuration (D–F) is almost equally rare: 4.0% against 2.6%. The whole difference lives in the middle band — B/C is twice as common in .ru, 26.0% against 13.6%. Russian sites are not breaking more often; they are more often under-configured.

We re-checked 87 previously B/C-graded hosts and broke the score down by component:

The protocol difference is not old versions left on, but the new one left off. Six in ten of the under-configured Russian hosts speak only TLS 1.2, against fewer than four in ten for .com. TLS 1.0 and 1.1 are off everywhere, as the measurement above shows.

Second: missing HSTS is not a Russian trait — 83–87% lack it in both zones, the common gap and the cheapest to close.

On sample size: 42 and 45 hosts is small. The 22-point spread on TLS 1.3 support is large and matches the direction of the independent survey; the cipher difference we do not consider established.

1. Turn TLS 1.3 on. What separates the under-configured Russian hosts is not old protocol left enabled but the new one never enabled. See TLS 1.3 vs TLS 1.2.
2. Turn HSTS on. The most common gap in both zones, one header — HSTS and HSTS Preload.
3. Confirm 1.0 and 1.1 really are off. No host in our sample supported them, but the sample does not cover the whole web — check your own domain.
4. Drop weak cipher suites — weak cipher suites.
5. Automate certificate issuance. 77.4% of top-million certificates live 48–90 days — the short lifetime is safe because renewal is not manual: free SSL with Let’s Encrypt.