Every week a stratified sample of the sites CrawlCheck measures is probed from GitHub-hosted runners: which TLS versions the server accepts, which key exchange it agrees, and whether it agrees post-quantum hybrid key exchange (X25519MLKEM768, RFC 10024) when that is the only group offered. Site names are not published; a site’s own result appears in its report.
Probe of 2026-11-09: 2,000 sites sampled, 1,970 reachable on port 443.
Measure
All
Local
SaaS
Gov
Wider
Post-quantum key exchangeshare of TLS 1.3 sites that agree X25519MLKEM768
73.3% 1,309 of 1,786
75.5% 496 of 657
79.8% 368 of 461
54.1% 158 of 292
76.3% 287 of 376
TLS 1.3 accepted
90.7% 1,786 of 1,970
94.3% 657 of 697
92.8% 461 of 497
77.2% 292 of 378
94.5% 376 of 398
TLS 1.0 still accepted
15.1% 297 of 1,970
11.5% 80 of 697
19.5% 97 of 497
13.5% 51 of 378
17.3% 69 of 398
TLS 1.1 still accepted
15.7% 309 of 1,970
11.6% 81 of 697
20.9% 104 of 497
14% 53 of 378
17.8% 71 of 398
RSA key exchange accepteddeprecated by RFC 10015
31.5% 621 of 1,970
26.4% 184 of 697
34.6% 172 of 497
43.9% 166 of 378
24.9% 99 of 398
Finite-field DHE accepteddeprecated by RFC 10015
16.2% 319 of 1,970
14.3% 100 of 697
9.3% 46 of 497
26.5% 100 of 378
18.3% 73 of 398
CBC ciphers accepted
61.2% 1,206 of 1,970
66% 460 of 697
57.3% 285 of 497
64.6% 244 of 378
54.5% 217 of 398
SHA-1 signatures accepted
55% 1,083 of 1,970
52.5% 366 of 697
58.6% 291 of 497
63.8% 241 of 378
46.5% 185 of 398
Passes all sevenno TLS 1.0/1.1, CBC, RSA or DHE key exchange, SHA-1 signatures or 0-RTT