HTTPS adoption has moved from a minority practice to the default for most measured websites. The long-run W3Techs series puts HTTPS at 90.1% of websites in 2024, while the 2025 Web Almanac records above 91% usage across desktop and mobile pages in its SEO dataset. The figures below separate website defaults, page-level measurements, request traffic, and security-policy settings so the comparisons remain meaningful.
Contents
- Long-run adoption trend
- Page type and device differences
- Traffic, homepages, and modern protocols
- TLS versions and certificate issuers
- HSTS adoption and enforcement
- Country, popularity, and category differences
Long-run adoption trend
The W3Techs historical series shows a steady rise in HTTPS as the default protocol. It measured HTTPS on 26.9% of websites in 2015 and 45.9% in 2016. Adoption then reached 57.4% in 2017, 68.8% in 2018, and 77.4% in 2019. The series recorded 81.2% in 2020, 84.9% in 2021, 87.7% in 2022, 87.6% in 2023, and 90.1% in 2024. These are annual W3Techs measurements, so the one-tenth-point decline between 2022 and 2023 should not be treated as a permanent reversal.
| Year | HTTPS default on websites |
|---|---|
| 2015 | 26.9% |
| 2016 | 45.9% |
| 2017 | 57.4% |
| 2018 | 68.8% |
| 2019 | 77.4% |
| 2020 | 81.2% |
| 2021 | 84.9% |
| 2022 | 87.7% |
| 2023 | 87.6% |
| 2024 | 90.1% |
Source: W3Techs, Historical yearly trends in the usage statistics of site elements for websites.
A separate view from Let’s Encrypt uses Firefox-measured connection prevalence rather than the W3Techs website-default measure. That series rose from below 30% to around 80% over approximately 2015–2020. By 2025, HTTPS connection prevalence in the United States had been close to 95% for a sustained period. The two sources measure different things: one describes website protocol configuration, while the other describes observed browser connections.
Page type and device differences
The 2025 HTTP Archive SEO dataset shows that HTTPS was used on 84.6% of desktop home pages and 86.6% of mobile home pages. Inner pages had higher measured adoption: 92.4% on desktop and 93.4% on mobile. Across all page types, HTTPS appeared on 91.7% of desktop pages and 91.5% of mobile pages.
| Page group | Desktop | Mobile |
|---|---|---|
| Home pages | 84.6% | 86.6% |
| Inner pages | 92.4% | 93.4% |
| All page types | 91.7% | 91.5% |
Source: HTTP Archive, SEO, Web Almanac 2025.
The page-level results show why a homepage-only audit can produce a different impression from a sitewide crawl. In this dataset, home pages were below inner pages on both device types. Mobile home pages were 2.0 percentage points above desktop home pages, while mobile inner pages were 1.0 point above desktop inner pages. For all page types together, desktop was 0.2 points above mobile. These are direct comparisons of the reported percentages, not estimates of a broader web population.
Traffic, homepages, and modern protocols
Request-level measurements are higher than several page-level SEO measurements. In the 2025 Web Almanac security dataset, HTTPS accounted for 98.8% of requests from mobile connections. The mobile HTTPS-request share increased by 0.74 percentage points from the 2024 edition to the 2025 edition.
The same security dataset measured HTTPS on 97.5% of desktop homepages and 97.3% of mobile homepages. Mobile homepage adoption rose from 95.6% in the prior edition to 97.3% in the 2025 edition. These homepage figures are therefore distinct from the 84.6% desktop and 86.6% mobile home-page results in the SEO dataset; the datasets use different measurement contexts.
The 2025 security measurements also show a transition in encrypted transport technology. TLS 1.3 powered roughly 76% of web pages. TLS 1.2 accounted for approximately 13% to 15% of encrypted web-traffic protocol share. QUIC represented 10.8% of the measured secure-traffic protocol share on mobile and 9.5% on desktop. Compared with the 2024 edition, TLS 1.2 adoption decreased by 4.5%, while QUIC adoption increased by 0.8%.
Source: HTTP Archive, Security, Web Almanac 2025.
TLS versions and certificate issuers
Certificate-issuer results provide another view of the HTTPS ecosystem. In 2025, the R11 issuer accounted for 20.80% of desktop certificates, followed by R10 at 20.75% and WE1 at 16.35%. E6 represented 4.50%, while E5 represented 4.31%.
On mobile, R11 accounted for 21.86% of certificates, R10 for 21.73%, and WE1 for 17.24%. E6 represented 4.65%, and E5 represented 4.42%. The mobile shares for these listed issuers were each slightly higher than their desktop counterparts in the supplied comparison.
| Certificate issuer | Desktop | Mobile |
|---|---|---|
| R11 | 20.80% | 21.86% |
| R10 | 20.75% | 21.73% |
| WE1 | 16.35% | 17.24% |
| E6 | 4.50% | 4.65% |
| E5 | 4.31% | 4.42% |
Source: HTTP Archive, Security, Web Almanac 2025.
These issuer percentages should not be added to TLS-version percentages. They describe different dimensions: certificate issuer identifies the organization associated with the certificate, while TLS and QUIC figures describe protocol use. A site can therefore contribute to both a certificate-issuer share and a protocol share without those categories being interchangeable.
HSTS adoption and enforcement
HTTPS availability does not by itself show whether a site asks browsers to enforce HTTPS on future visits. In the 2025 security dataset, the HSTS header appeared on 36% of mobile pages, 6 percentage points higher than in the prior Web Almanac edition.
Among measured HSTS responses, 96% had a valid max-age directive. A zero HSTS max-age, which disables the policy, appeared in 4% of measured HSTS responses. The includeSubDomains directive was used by roughly 40% of sites with HSTS, and the preload directive by about 22% of sites with HSTS.
The reported HSTS lifetime distribution was broad. The median valid max-age was 365 days on both desktop and mobile. The 10th-percentile valid max-age was 91 days, while the 90th-percentile value was 730 days. These percentiles describe valid HSTS settings and should not be read as adoption rates.
Together, the figures distinguish three questions: whether pages use HTTPS, whether responses advertise HSTS, and how long a valid HSTS policy lasts. The first is nearly universal in the traffic and homepage measurements, while the second remains much less common among mobile pages. HSTS is therefore a separate implementation stage rather than a synonym for HTTPS adoption.
Country, popularity, and category differences
The 2025 country comparison reported desktop HTTPS adoption of 99.70% in New Zealand, 99.67% in Switzerland, and 99.67% in Nigeria. The reported figures were 94.17% in Japan and 95.34% in the Republic of Korea. Every country shown in that comparison exceeded 94% desktop HTTPS adoption.
| Country | Desktop HTTPS adoption |
|---|---|
| New Zealand | 99.70% |
| Switzerland | 99.67% |
| Nigeria | 99.67% |
| Republic of Korea | 95.34% |
| Japan | 94.17% |
Source: HTTP Archive, Security, Web Almanac 2025.
Popularity and site selection still matter when interpreting security coverage. The X-Frame-Options header appeared on 67% of the top 1,000 mobile sites, compared with 30% of all mobile sites visited by the browser in 2025. This is a security-header comparison, not a direct HTTPS comparison, but it shows how the measured site population can change a result.
The same dataset reported category differences in the average number of security headers on mobile sites. Internet and Telecom sites averaged 4.6 security headers, while Computers and Electronics sites averaged 4.0. Law and Government and Travel and Transportation sites each averaged 1.3 security headers per site. These category averages cover broader security-header presence, so they should not be substituted for HTTPS percentages.
For SEO teams, the practical reading is precise: HTTPS is the dominant web protocol, but adoption statistics depend on whether the unit is a website, page, homepage, request, country sample, or security policy. The 2025 measurements also show that certificate and transport details, HSTS enforcement, site popularity, and category all provide information that a single HTTPS percentage cannot capture.