Top 1 Million Analysis – June 2026: Ten Years of Web Security

Scott Helme · 29 Jun 2026 · scotthelme.co.uk ↗

4 korrents from this piece

Scott Helme did not write this page.

Every claim below was made in this piece, quoted word for word and numbered in the order the piece makes them, so you can read it there rather than take our word for it. The sentence above each quote is our reading of the claim, not their wording. Each quote was checked against a stored copy of the page at build time; where the two differ, the quote is the fact.

Our reading
The web really is more secure than it was a decade ago.

Their wordsThe web really is more secure than it was a decade ago.

Interesting
Our reading
HTTPS is now simply how the web works, and the long tail of plain-HTTP sites shrinks every year.

Their wordsHTTPS is now simply how the web works, and the long tail of plain-HTTP sites is shrinking every year.

Interesting
Our reading
A security header being present is not the same as it being deployed well, and most HSTS deployments are weaker than they look.

Their wordsA lot of HSTS deployments are weaker than they look.

Interesting
Our reading
Content Security Policy adoption has more than doubled while nearly half of the policies still contain directives that undermine them.

Their wordsSo while CSP adoption has more than doubled, nearly half of all policies are in need of some TLC.

Interesting