HTTPS adoption in the 2025 Web Almanac: 97% of homepages

Ask whether HTTPS helps you rank and you get a debate about a lightweight signal. Ask how many sites use it and the answer is almost all of them. The HTTP Archive’s 2025 Web Almanac puts a number on that second question, and the number is the reason the first one has faded. This piece reports the Almanac’s Security chapter; SEO Madman did not run the crawl.

How high is HTTPS adoption in the 2025 Web Almanac?#

The Security chapter reports that the share of all requests sent over HTTPS rose again, reaching over 98.8% for mobile connections. At the homepage level, mobile adoption rose from 95.6% to 97.3%, and desktop stands at 97.5%. The chapter explains the gap: sites send many third-party requests, so the homepage figure tends to sit lower than the request figure while still climbing each year. It credits browser vendors’ HTTPS-first policies as one contributing factor.

What else does the chapter measure about secure connections?#

Adoption is only the first layer. The chapter also looks at how HTTPS is configured, which is where the remaining differences between sites now sit.

• Protocol versions: TLS 1.3 secures roughly 76% of pages and TLS 1.2 about 13 to 15%, according to the chapter’s protocol chart. QUIC, often associated with HTTP/3, accounts for 10.8% on mobile and 9.5% on desktop.
• HSTS: the Strict-Transport-Security header, which tells browsers to use only HTTPS for a domain instead of trying HTTP first and following a redirect, is on 36% of mobile pages, up 6 percentage points from the previous edition. Of those, 96% set a valid max-age.
• Certificates: Let’s Encrypt issues the certificates for 52.6% of mobile pages, down slightly from 56%, with more certificates now coming from newer intermediates and from Google Trust Services.

The practical reading is that nearly every site has a certificate, but only about a third of mobile pages tell browsers to skip the insecure first request.

How was the data collected?#

The Almanac draws on HTTP Archive, run through WebPageTest, plus Chrome UX Report data. Unless a chapter says otherwise, metrics come from the July 2025 crawl of 16,213,084 websites, split across mobile and desktop. Read this as a lab measurement: pages are tested from a datacenter, not by real users, and the methodology notes that a home page is not necessarily representative of a whole site.

What does this not tell you about ranking?#

Nothing here measures search position. For ranking, the primary source remains Google’s own statements, covered in HTTPS as a ranking signal in 2026. Google’s page experience documentation lists “Are your pages served in a secure fashion?” among its self-assessment questions, and also says that beyond Core Web Vitals, other page experience aspects don’t directly help a site rank higher. It adds that Google always seeks to show the most relevant content, even if the page experience is sub-par.

Adoption this high means HTTPS is a baseline for technical SEO, so lacking it is a defect, while having it is no advantage.

What should a site owner check?#

The census cannot tell you about your own site, and Google’s duplicate URL documentation says what matters for it. Google prefers HTTPS pages over equivalent HTTP pages as canonical, except when there are conflicting signals: an invalid certificate, insecure dependencies other than images, an HTTPS page that redirects to or through HTTP, or a canonical link pointing to the HTTP page.

To make the preference stick, Google lists three actions: redirect HTTP pages to HTTPS, add a canonical link from the HTTP page to the HTTPS page, or implement HSTS. It also warns against listing HTTP URLs in sitemaps or hreflang annotations. The redirect chain analyzer flags hops that drop from https back to http, the case Google says makes it prefer HTTP very strongly.