Readiness check · Harden lane · weight 4

CAA records limit who can issue certificates

A CAA record exists on the host or its registrable domain.

Observed on: 13%
Top 1K sites: 24%
Top 1M band: 7.7%
Not measured: 249

Why it matters

CAA records tell certificate authorities which of them may issue certificates for your domain, which narrows the chance of a mistaken or fraudulent certificate.

How to fix it

Publish CAA records naming every CA you actually use, including the CAs your CDN uses for managed certificates. Add an iodef contact if you want reports.

How we check

A CAA record exists on the host or its registrable domain.

Observed: CAA record published.

Not observed: No CAA record found.

Limit: Read from public DNS at the time of the check; records may have changed since.

Stack-specific steps

Cloudflare: Cloudflare documents which CAs its managed certificates need; include them in your CAA records.

By popularity band

Chrome UX Report band	Observed	Measured
Top 1K	24%	450
Top 5K	18%	2,081
Top 10K	16%	2,523
Top 50K	14%	18,640
Top 100K	13%	5,267
Top 500K	11%	5,342
Top 1M	7.7%	5,543

Categories most likely to do this

Categories least likely

By stack

Next.js on Vercel45%
Shopify33%
Astro23%
Next.js on Google edge22%
Drupal on Cloudflare22%
Webflow21%
Next.js on Cloudflare18%
Sitecore17%
Next.js17%
WordPress on Cloudflare16%
Angular16%
Adobe Experience Manager16%
Drupal14%
Next.js on Akamai14%
Next.js on Fastly14%
Adobe Experience Manager on Amazon CloudFront13%
Next.js on Amazon CloudFront13%
Nuxt on Cloudflare11%
WordPress11%
WordPress on Amazon CloudFront10%
PrestaShop9.8%
Nuxt9.2%
Nuxt on Amazon CloudFront8.5%
Magento / Adobe Commerce5.9%
Blogger3.7%

By provider

Popular sites where we observed this

Sources and guides

Guide: HTTPS and TLS Guide for Website Owners Check your own site