Top 1 Million Analysis – June 2026: Ten Years of Web Security
A ten-year retrospective crawl of the Tranco Top 1 Million websites measuring web security adoption as of June 2026. Key findings: HTTPS redirects now cover 658,038 sites (up from 62,043 in 2015), CSP has grown 12,360% over the decade but nearly half of all policies still contain unsafe-inline or unsafe-eval. HSTS is on 252,846 sites but only 21% are preload-eligible. Referrer-Policy tripled since 2022. New metrics this year include cookie security attributes, DMARC/SPF records, and cross-origin isolation headers (COOP/COEP). Cloudflare fronts over a third of responding sites, heavily skewing aggregate metrics. Over half the web still scores an F on security headers, though the F count dropped by ~124,000 since 2022. Part two will cover TLS, certificate lifetimes, and post-quantum cryptography.
