HTTPS & SSL Adoption Statistics: How Many Websites Actually Use It in 2026?
Compiled from W3Techs’ web technology survey, Google’s Transparency Report, Let’s Encrypt’s own certificate data and APWG phishing reports — where HTTPS adoption stands today, how it got here year by year, and why a padlock icon stopped meaning what it used to.
📋 What’s in this page
Key HTTPS Adoption Statistics
HTTPS adoption is now high enough that it’s treated as a baseline expectation rather than a differentiator — but a meaningful minority of websites still doesn’t send visitors to HTTPS by default.
HTTPS Adoption Year by Year
The biggest jumps came between 2018 and 2021 — the same period in which Chrome began labeling plain-HTTP pages “not secure” (July 2018) and free, automated certificates spread. Growth has slowed since then.
Websites using HTTPS by default
Share of all websites that send visitors to HTTPS by default, on 1 January of each year plus the latest reading.
Source: W3Techs, historical yearly trends in the usage of site elements.Free to reuse with attribution and a link to paidhosting.com
| Pages loaded over HTTPS in Chrome | Windows | Mac | Android | Linux |
|---|---|---|---|---|
| January 2016 | 42% | 48% | 35% | 45% |
| January 2018 | 69% | 78% | 68% | 64% |
| January 2020 | 84% | 91% | 88% | 74% |
| January 2022 | 91% | 95% | 95% | 79% |
| January 2024 | 94% | 97% | 98% | 80% |
| January 2026 | 95% | 98% | 99% | 84% |
| October 2026 | 95% | 98% | 99% | 88% |
Source: Google Transparency Report, “Percentage of pages loaded over HTTPS in Chrome by platform” (first weekly reading of each January; latest 4 October 2026). Measured from Chrome users who share usage statistics.
Active Let’s Encrypt certificates
Certificates active on 1 January of each year, plus the latest reading, in millions.
Source: Let’s Encrypt, daily certificate statistics (latest 6 October 2026). As of that date the active certificates covered 722.8 million fully qualified domain names and 232.9 million registered domains, with about 8.7 million certificates issued that day.Free to reuse with attribution and a link to paidhosting.com
Adoption by Site Popularity, Platform and Country
Neither W3Techs nor Google publishes HTTPS adoption by industry, so we haven’t invented one. What they do publish shows adoption rising with a site’s traffic, and near-universal HTTPS on hosted platforms that handle certificates for their users.
| Site Segment | HTTPS by Default |
|---|---|
| All websites | 90.2% |
| Top 1,000,000 websites | 93.7% |
| Top 100,000 websites | 94.3% |
| Top 10,000 websites | 95.4% |
| Top 1,000 websites | 96.4% |
| Websites built with WordPress | 92.4% |
| Websites built with Shopify | 99.6% |
| Websites built with Wix | 99.8% |
| .com websites | 90.8% |
| .org websites | 90.5% |
Source: W3Techs, default protocol HTTPS broken down by ranking, content management system and top-level domain, 8 October 2026.
| Country / region | Pages loaded over HTTPS in Chrome |
|---|---|
| United States | 98% |
| France | 98% |
| Germany | 97% |
| Türkiye | 97% |
| Brazil | 96% |
| Russia | 96% |
| Japan | 95% |
| India | 93% |
| Mexico | 93% |
| Indonesia | 90% |
Source: Google Transparency Report, “Percentage of pages loaded over HTTPS in Chrome by country/region”, week of 4 October 2026.
Who Issues the Certificates
Free, automated certificates now dominate. Let’s Encrypt entered public beta in December 2015, left beta in April 2016 with more than 1.7 million certificates issued, and is now the certificate authority behind most of the web.
| Certificate authority | Share of All Websites |
|---|---|
| Let’s Encrypt | 64.3% |
| GlobalSign | 20.9% |
| Sectigo | 4.6% |
| GoDaddy Group | 3.5% |
| DigiCert Group | 1.6% |
| No SSL certificate | 2.4% |
| Certificate for the wrong domain | 1.6% |
| Expired certificate | 0.6% |
Source: W3Techs, usage statistics of SSL certificate authorities, 8 October 2026; Let’s Encrypt, “Leaving Beta, New Sponsors” (12 April 2016).
Google found that the largest source of remaining insecure HTTP traffic in Chrome is navigation to private sites, not the public web. Counting public sites only, HTTPS rises from 84% to nearly 97% on Linux and from 95% to 98% on Windows, and is above 99% on Android and Mac. On the public web, W3Techs’ data shows adoption rising with traffic: 96.4% of the top 1,000 sites use HTTPS by default, against 90.2% of all sites.
The Padlock Doesn’t Mean What It Used To
For years, security guidance told users to “look for the padlock” before trusting a website. That advice is now misleading, because attackers adopted HTTPS as quickly as everyone else.
| Period | Phishing sites using SSL/HTTPS |
|---|---|
| End of 2016 | Under 5% |
| Q4 2017 | Nearly a third |
| Q4 2018 | About 47% |
| Q1 2019 | 58% |
| Q4 2019 | 74% |
| Q3 2020 | 80% |
| Q2 2021 | 82% |
Source: APWG Phishing Activity Trends Reports (Q4 2017 to Q2 2021), figures contributed by PhishLabs. The APWG reports we checked from Q3 2021 onward no longer include this measurement.
A padlock only confirms that traffic between a browser and a site is encrypted in transit; it says nothing about who controls that site or what they intend to do with it, and free, automated certificate issuance made it just as easy for attackers to obtain one as for anyone else. With HTTPS now the default on 90% of websites, the presence of a padlock tells a visitor very little — its absence is more informative than its presence.
What This Means for Site Owners
HTTPS is no longer optional from a search or user-trust standpoint. Google has used it as a ranking signal since August 2014, Chrome has labeled every plain-HTTP page “not secure” since Chrome 68 in July 2018, and with Chrome 154 in October 2026 Google is turning on “Always Use Secure Connections” by default, which warns users before Chrome loads a public site over plain HTTP. Browsers also restrict modern features such as camera, microphone, geolocation and service workers to secure origins. If your site still doesn’t send visitors to HTTPS by default, the fix today costs nothing and typically takes minutes through your host or CDN’s automated certificate tooling.
At the same time, don’t mistake the padlock for a security strategy. HTTPS protects data in transit; it does nothing to stop a vulnerable plugin, a weak password, or a phishing page from being just as convincingly “secure-looking” as a legitimate one.
Sources & Methodology
Website adoption figures come from W3Techs’ web technology survey, which records whether a site redirects visitors to HTTPS by default (readings dated 8 October 2026 unless noted). Browser figures come from Google’s Transparency Report, which measures the share of pages loaded over HTTPS by Chrome users who share usage statistics. Certificate counts come from Let’s Encrypt’s published daily statistics. Phishing figures come from APWG’s quarterly Phishing Activity Trends Reports, as contributed by PhishLabs. Chrome and Google Search policy dates come from Google’s and Chromium’s official blogs. We could not find a current industry-by-industry HTTPS adoption breakdown from any primary source; if one is published, this page will be updated with it.
- W3Techs — Usage statistics of default protocol HTTPS (overall, by ranking, CMS and top-level domain); historical yearly trends of site elements; SSL certificate authorities (October 2026)
- Google Transparency Report — HTTPS encryption on the web (October 2026)
- Let’s Encrypt — certificate statistics (6 October 2026); “Leaving Beta, New Sponsors” (April 2016)
- APWG — Phishing Activity Trends Reports, Q4 2017 – Q2 2021 (PhishLabs data)
- Google Security Blog — “HTTPS by default” (October 2025); Chromium Blog — “A secure web is here to stay” (February 2018); Google Search Central — “HTTPS as a ranking signal” (August 2014)
Cite this analysis
https://www.paidhosting.com/https-ssl-adoption-statistics/
Findings on this page may be reproduced with attribution and a link back to this page. Press and data inquiries: [email protected]