{"id":8178,"date":"2018-12-12T16:00:28","date_gmt":"2018-12-12T21:00:28","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=8178"},"modified":"2025-03-28T07:53:53","modified_gmt":"2025-03-28T11:53:53","slug":"nearly-21-of-the-worlds-top-100000-websites-still-arent-using-https","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/nearly-21-of-the-worlds-top-100000-websites-still-arent-using-https\/","title":{"rendered":"Nearly 21% of the world\u2019s top 100,000 websites still aren\u2019t using HTTPS"},"content":{"rendered":"\n

6.8% of the top 100,000 still support SSL 2.0 and SSL 3.0, too<\/h2>\n\n\n\n

For as quickly as HTTPS has proliferated, there are still a few stragglers out there. Quite a few actually. In fact, nearly 21% (20,911) of the Alexa Top 100,000 websites still aren\u2019t using HTTPS.<\/p>\n\n\n\n

That\u2019s one of several interesting takeaways from WatchGuard\u2019s Q3 Internet Security Report<\/a>, which came out earlier this week. Among other interesting tidbits: despite calls to deprecate support for SSL 2.0 and SSL 3.0 from a number of different industry and regulatory bodies\u2014they both persist.<\/p>\n\n\n\n

So today we\u2019re going to break down WatchGuard\u2019s report.<\/p>\n\n\n\n

Or at least the parts that are in-scope for us.<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

Before we start, let\u2019s put the Alexa Top 100,000 in context<\/h2>\n\n\n\n

For all intents and purposes, the Alexa 100,000 doesn\u2019t exist in a practical sense. There is no list you can pull down off the internet. They used to publish a top 1,000,000, but discontinued it in 2016. Scott Helme will occasionally publish some information on it<\/a>, but other than that this data isn\u2019t terribly accessible.<\/p>\n\n\n\n

If you want know the ranking of a specific website, you can go to Alexa.com<\/a> and search individually by URL.<\/p>\n\n\n

\n
\"The<\/figure>\n<\/div>\n\n\n

There is a ready-made list of Alexa rankings, you just have to pay for it. And it’s not like they make it easy to find<\/a>, which makes work like this even more valuable\u2014given the barrier to entry with this kind of research.<\/p>\n\n\n<\/span>\n\n\n\n

There is some necessary context before we start slinging around statistics though. As the report states it:<\/p>\n\n\n\n

\n

We suspected the top websites make up most of the Internets users\u2019 page visits. To prove this, we used the Alexa top 100,000 results and results from similarweb.com. Alexa compiles a list of the top one million websites in order of the most visited. Similarweb.com also compiles the top websites by the most visited and provides estimated visits per month for the most popular websites.<\/p>\n<\/blockquote>\n\n\n\n

The numbers back that up. Not all is equal within the top 100,000. The traffic is largely consolidated amongst the top 100 or so websites. The difference between the world\u2019s top site (Google) and the world\u2019s 100,000th<\/sup> is staggering, with no. 1 receiving over 143,000 times the traffic the 100,000th<\/sup> site receives each month.<\/p>\n\n\n\n

Or to put that in even starker terms: Google receives as much traffic every 20 seconds as the world\u2019s 100,000th<\/sup> most trafficked website receives in one month. Here\u2019s a visualization of how the traffic stacks up across the top 100,000, courtesy of WatchGuard.<\/p>\n\n\n

\n
\"Nearly<\/figure>\n<\/div>\n\n\n

Now let\u2019s get to the fun stuff.<\/p>\n\n\n\n

Nearly 21% of the world\u2019s top 100,000 websites still aren\u2019t using HTTPS<\/h2>\n\n\n\n

Let\u2019s start right at the top with the most worrisome statistic: one in five of the Alexa Top 100,000 websites is still being served via HTTP. At this point it feels like I\u2019ve been beating this dead horse for three years (I have), but we should be past the stage where whether to use HTTPS is even a conversation.<\/p>\n\n\n

\n
\"At<\/figure>\n<\/div>\n\n\n

The internet was not designed to be secure because it didn\u2019t need to be secure when it was designed. I realize that\u2019s a confusing sentence, but at the time the internet was being developed and these protocols were being created, there wasn\u2019t a whole lot of private, sensitive information on the internet. Commercial activity was banned back then, the main use case was the free exchange of information between government entities and academia.<\/p>\n\n\n\n

Obviously, that couldn\u2019t be further from the reality of today\u2019s internet. And just like cars didn\u2019t have seatbelts when they were first created and we had to mandate them later, we\u2019ve now mandated that websites should be connecting securely via port 443 instead of spraying plaintext from port 80. HTTP connections are not secure. Anyone that\u2019s eavesdropping on any of the dozens of devices your connection routes through on the way to its destination can easily harvest or manipulate any information being exchanged.<\/p>\n\n\n\n

Seriously, we wrote about this a few weeks ago, if people actually knew how many points their connection passes through when they visit a website, the mere mention of HTTP would be met with pitchforks and torches<\/a>. Even Google \u2013 of the \u2018don\u2019t be evil\u2019 ethos \u2013 has been kneecapping websites for not using HTTPS<\/a>.<\/p>\n\n\n\n

So, with that in mind let\u2019s check out the breakdown of websites in the Alexa top 100,000 that use HTTPS versus the incorrigible websites still being served over HTTP.<\/p>\n\n\n

\n
\"Nearly<\/figure>\n<\/div>\n\n\n

Again, the majority of these websites are going to be towards the back half of the top 100,000, but 20+% is not negligible, either. Clearly there is still plenty of work to be done on the HTTPS migration front.<\/p>\n\n\n<\/span>\n\n\n\n

6.8% of those HTTPS websites still support SSL 2.0 and\/or SSL 3.0<\/h2>\n\n\n\n

Let\u2019s talk about SSL and TLS protocol versions<\/a>. And this harkens back to an old conversation about the difference between SSL and TLS<\/a>. SSL or Secure Sockets Layer was the original protocol, developed in the mid-90s by Netscape. The initial version, SSL 1.0, never got off the ground. SSL 2.0 was published but short-lived. SSL 3.0 was the final iteration of the SSL protocol, after that it became TLS or Transport Layer Security, which is a similar protocol, but the two aren\u2019t necessarily interchangeable, either.<\/p>\n\n\n\n

We\u2019re currently on TLS 1.3<\/a>. Currently, best practice is not to support SSL 2.0 or SSL 3.0 \u2013 both are considered unsecure as a result of known exploits like POODLE and DROWN \u2013 with TLS 1.0 and TLS 1.1 due to be completely deprecated by 2020<\/a> (the payment card industry has already mandated this deprecation<\/a>).<\/p>\n\n\n\n

So now let\u2019s look at SSL\/TLS version support across the Alexa top 100,000. We\u2019ll start by looking at the highest protocol supported:<\/p>\n\n\n

\n
\"Nearly<\/figure>\n<\/div>\n\n\n
None<\/td>TLS 1.3<\/td>TLS 1.2<\/td>TLS 1.1<\/td>TLS 1.0<\/td>SSL 3.0<\/td>SSL 2.0<\/td><\/tr>
20,911<\/td>17,345<\/td>59,830<\/td>53<\/td>2,221<\/td>5<\/td>0<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

There were some interesting tidbits that came up when WatchGuard rolled up its sleeves and really got elbow deep in the data. For instance:<\/p>\n\n\n\n