TLDR Tech / InfoSec
Top 1 Million Analysis – June 2026: Ten Years of Web Security
Scott Helme's decade retrospective on the Tranco Top 1 Million (819,002 responding sites) shows the foundational web-security primitives now firmly entrenched: HTTPS redirects have climbed roughly 960% since 2015 to 658,038 sites, CSP has grown 125x to 170,057, and HSTS sits at 252,846, yet the headline story is that presence has decoupled from quality, with 46.8% of CSPs still carrying unsafe-inline, only 21% of HSTS deployments preload-eligible, and DMARC stuck at p=none on 51.4% of publishing domains. The structural takeaway is concentration risk: Cloudflare now fronts over a third of responding sites and single-handedly drives aggregate movement in NEL, HTTP/3, and the cross-origin isolation family whenever it flips a default, meaning much of the web's measured "progress" reflects one provider's configuration rather than independent operator decisions. Helme runs sponsor Report URI and folds in course and product mentions, so read the optimistic framing accordingly, but the core signal stands: with over half the population still scoring an F on basic headers, the next decade's lever is correct configuration and better platform defaults, not further raw adoption.
Read the full story