50% of the websites now redirect their traffic to https encrypted pages

Posted by Matthias Gelbmann on 8 April 2019 in News, Default Protocol Https, Site Elements

In the ancient times of the internet - like 10 years ago - encrypting websites via an SSL certificate was primarily reserved to e-commerce sites and online banking. Two events have changed that: First, in 2014 Google announced that they will use https encryption as a ranking signal, thus providing a strong incentive for webmasters to make the switch. Second, Mozilla and others formed the Internet Security Research Group, which started to hand out free SSL certificates via the Let's Encrypt initiative in 2016.

Https adoption rate has rapidly grown since than. Half of all websites now default to an encrypted protocol by redirecting its http traffic to https URLs. That percentage has more than doubled in the last 18 months.

Interestingly, significantly more sites, namely 67.6%, have a valid SSL certificate issued and installed. However, 17.6% just serve the unencrypted version unless you explicitly ask for encryption by entering the https URL into your browser. That might me laziness in configuring the web server correctly, but there could also be good reasons for webmasters doing so, for example sites may still serve some resources such as images or JavaScript files unencrypted, which might break the https-version of the site.

High-traffic sites are more likely to redirect to https. 85.1% of the top 1000 sites do it. The only top 10 site that currently still servers unencrypted pages is the Chinese search engine Baidu, although they are also reachable via https.

Even more rigorous that redirecting to https is to enforce encrypted communication via the HTTP Strict Transport Security directive. As per today, only 10% of all sites and 39% of the top 1000 sites use that option.

There are quite big regional differences: 79.2% of Dutch sites and 70.2% of German sites redirect, but only 14.0% of Korean sites and 14.5% of Chinese sites do so.

For some reason, also the web server technology of a site seems to play a role: while 57.4% of Nginx-based sites redirect to https, that percentage is only 34.5% for Microsoft-IIS-sites.

I assume at some point in the future all web traffic will be encrypted. Let's see how the trends evolve until then.

_________________
Please note, that all trends and figures mentioned in that article are valid at the time of writing. Our surveys are updated frequently, and these trends and figures are likely to change over time.

Share this page