333 S&P 500 Companies Are Serving HTTPS Without HSTS — 97% Have No Bounty Program

Our eighth cross-reference. A downgrade-attack surface hiding in plain sight: HTTPS is up, but nothing tells the browser to stay there.

NullBlocks Research — August 2026

HTTP Strict Transport Security (HSTS) is one of the cheapest security controls a web server can ship — a single response header (Strict-Transport-Security) that tells browsers "never downgrade this connection to plain HTTP again, for at least this long." Without it, every visitor is one stripped redirect, one captive-portal Wi-Fi, or one sslstrip-class MITM away from having their session quietly downgraded — even though the server is running HTTPS correctly.

It costs nothing to add, breaks nothing to test, and is one of the first things checklists like OWASP's Secure Headers Project and Mozilla's Observatory grade a site on. So we asked a simple question across the whole index: how many S&P 500 companies are actually shipping it?

Methodology, up front

We took the latest live HTTPS response (200–399) recorded for every scanned host across the S&P 500 and checked whether the Strict-Transport-Security header was present in the response headers we captured. A host with a 2xx/3xx HTTPS response but no HSTS header is a confirmed miss — this isn't a guess about server configuration, it's the literal header set the server sent back, headers we already had on file from routine attack-surface scanning. We then cross-referenced the affected companies against HackerOne's public bounty-scope data, the same dataset used in all seven of our previous reports.

What we found

333 of 543 S&P 500 companies (61.3%) have at least one live HTTPS host that never sends an HSTS header — 10,314 individual host findings across the index. That's not a handful of stragglers; it's a majority of the index.

323 of those 333 companies (97.0%) have zero matched HackerOne bounty coverage anywhere — 10,075 of the 10,314 finding rows (97.7%) sit on infrastructure with no bug bounty program to report it to, even informally. This is the same disclosure-gap shape as every one of our first seven reports, on an eighth independent exposure class.

The 15 largest affected companies by raw host count:

Every one of those 15 has zero matched bounty coverage on file. Palo Alto Networks — a company that sells network security products for a living — sits on this list at 118 hosts.

Why this matters, not just as a checkbox

Missing HSTS doesn't mean a site is "insecure" in the way an open Redis port or a version-matched critical CVE is. It's a missing hardening control, not an active exploit. But it's exactly the kind of finding that:

• Is trivial to verify — no scanning tools, no exploit chain, just a missing response header any researcher can see in their browser's network tab in seconds.
• Is trivial to fix — one line in most web server or CDN configurations, no application code changes.
• Compounds with everything else on this list. A company with an expired TLS cert (our sixth report) and no HSTS on the same host has two independent reasons a downgrade or MITM attack against that host succeeds cleanly.
• Is exactly the class of low-effort, high-signal finding that bounty programs are built to absorb — and 97% of the affected companies have nowhere for a researcher to send it.

Eight reports, one pattern

This is the eighth independently-derived exposure class we've published from the same underlying dataset — after subdomain takeover risk, GraphQL introspection, Wayback-archived legacy pages, version-matched critical CVEs, exposed database/admin ports, expired TLS certificates, and unmonitored sister domains via reverse WHOIS. Every single one has landed in the same 90-97% no-bounty-coverage range. The pattern isn't which exposure class you pick — it's that most of the S&P 500 simply has no formal channel for a security researcher to report anything, no matter how it was found.

Data pulled from NullBlocks' live DomRecon scan database, cross-referenced against HackerOne's public program directory. Methodology and full company list available on request.