SunuSSLPulse: what our scans reveal about the real state of TLS

Not a vendor report with unverifiable global figures — the real data from our own SSL/TLS scans, target by target. The good news and the real weak point, without rounding either one in our own favor.

October 18, 2026 · SunuCyberSecurity team

Source: SunuSSLPulse, computed live from our real scans — data as of October 18, 2026

SunuSSLPulse isn't a survey — it's a live computation over our own security scan results, for every target that received an in-depth TLS analysis. Of 272 targets with at least one completed scan, 76 were tested in depth on TLS 1.3, Perfect Forward Secrecy, Heartbleed, certificate validity and HSTS presence. Here's what those 76 show, without extrapolating to the other 196 that didn't get that level of analysis.

The good signal: the TLS baseline is nearly secured

Among the 76 tested targets, 100% support TLS 1.3 (the most recent protocol), 100% have Perfect Forward Secrecy enabled (every browsing session stays protected even if a private key is compromised later), and 100% are no longer vulnerable to Heartbleed — expected for a 2014 flaw, but worth verifying rather than assuming.

The grade distribution (A through D, computed per target from the proportion of positive signals) confirms the trend: 43 targets at A, 26 at B, only 7 at C and none at D.

The real weak point: HSTS missing six times out of ten

Only 40% of checked targets (51 of 129 — HSTS is checked more broadly than the full TLS analysis) have a correctly configured HSTS (HTTP Strict Transport Security) header. Without HSTS, a visitor who types the site's address without "https://" can briefly land on an unencrypted, interceptable connection — even if the site itself serves HTTPS properly. It's one configuration line, not a heavy technical project, and exactly the kind of oversight an automated audit catches in seconds.

Certificates: 84% valid, 16% with a real problem

64 of the 76 tested targets have a valid, correctly configured SSL certificate. The remaining 12 (16%) have a real issue — expiration, an incomplete trust chain, or an invalid certificate — that triggers a visible security warning in every visitor's browser. For a professional site, that's the digital equivalent of a storefront with a "danger" sign the browser itself stuck on it.

Methodology

Data computed live from the real results of scans run through the SunuCyberSecurity platform (SSLyze), not an external sample or a survey. The scope reflects targets actually scanned on our platform, not a representative sample of the African web as a whole — see sunucybersecurity.com/en/ssl-pulse for the full methodology. Data as of October 18, 2026.

Related reading

Put this into practice

A free scan, in a few minutes, no credit card.