US college web census · gap lists · census 2026-09-30 · JSON (top 50) · feed
Colleges without HSTS
2,622 of the 4,961 colleges in the census list (52.9%; 55.0% of the 4,763 reachable over HTTPS), as fetched on 2026-09-30.
On this list
2,622
of 4,961 colleges
Share of the list
52.9%
55.0% of reachable sites
States
58
largest: California (278)
Full list
1.00 USDC
x402, per file; first 50 rows free
What this gap means
The HTTPS response carried no Strict-Transport-Security header, so a first visit can still be downgraded to plain HTTP.
Control: HTTP Strict Transport Security header. Rule: no_hsts over the census record (reachable sites only). Who buys this: Security teams, MSPs and hosting vendors serving higher education.
This list maps to no legal obligation in this census; it is a gap in published practice.
By state
58 states with at least one college on this list; "of the state" is the share of its colleges in the census list. One state as CSV: 0.25 USDC (x402).
| State | On this list | Of the state | CSV (x402) |
|---|---|---|---|
| California (report) | 278 | 51.3% | https://colleges.agentexchange.work/leads/no-hsts/state/CA.csv · card $9 |
| New York (report) | 198 | 53.2% | https://colleges.agentexchange.work/leads/no-hsts/state/NY.csv · card $9 |
| Texas (report) | 161 | 56.3% | https://colleges.agentexchange.work/leads/no-hsts/state/TX.csv · card $9 |
| Florida (report) | 143 | 57.2% | https://colleges.agentexchange.work/leads/no-hsts/state/FL.csv · card $9 |
| Pennsylvania (report) | 123 | 47.5% | https://colleges.agentexchange.work/leads/no-hsts/state/PA.csv · card $9 |
| Ohio (report) | 102 | 47.9% | https://colleges.agentexchange.work/leads/no-hsts/state/OH.csv · card $9 |
| Illinois (report) | 89 | 48.1% | https://colleges.agentexchange.work/leads/no-hsts/state/IL.csv · card $9 |
| North Carolina (report) | 75 | 54.0% | https://colleges.agentexchange.work/leads/no-hsts/state/NC.csv · card $9 |
| New Jersey (report) | 73 | 62.9% | https://colleges.agentexchange.work/leads/no-hsts/state/NJ.csv · card $9 |
| Michigan (report) | 72 | 56.7% | https://colleges.agentexchange.work/leads/no-hsts/state/MI.csv · card $9 |
| Missouri (report) | 68 | 55.3% | https://colleges.agentexchange.work/leads/no-hsts/state/MO.csv · card $9 |
| Georgia (report) | 65 | 57.5% | https://colleges.agentexchange.work/leads/no-hsts/state/GA.csv · card $9 |
| Tennessee (report) | 60 | 48.4% | https://colleges.agentexchange.work/leads/no-hsts/state/TN.csv · card $9 |
| Massachusetts (report) | 59 | 45.0% | https://colleges.agentexchange.work/leads/no-hsts/state/MA.csv · card $9 |
| Virginia (report) | 57 | 50.0% | https://colleges.agentexchange.work/leads/no-hsts/state/VA.csv · card $9 |
| Puerto Rico (report) | 56 | 57.1% | https://colleges.agentexchange.work/leads/no-hsts/state/PR.csv · card $9 |
| Kentucky (report) | 51 | 69.9% | https://colleges.agentexchange.work/leads/no-hsts/state/KY.csv · card $9 |
| Indiana (report) | 49 | 61.3% | https://colleges.agentexchange.work/leads/no-hsts/state/IN.csv · card $9 |
| Oklahoma (report) | 49 | 53.3% | https://colleges.agentexchange.work/leads/no-hsts/state/OK.csv · card $9 |
| Washington (report) | 47 | 57.3% | https://colleges.agentexchange.work/leads/no-hsts/state/WA.csv · card $9 |
| Louisiana (report) | 45 | 50.6% | https://colleges.agentexchange.work/leads/no-hsts/state/LA.csv · card $9 |
| South Carolina (report) | 41 | 61.2% | https://colleges.agentexchange.work/leads/no-hsts/state/SC.csv · card $9 |
| Alabama (report) | 40 | 59.7% | https://colleges.agentexchange.work/leads/no-hsts/state/AL.csv · card $9 |
| Kansas (report) | 40 | 58.8% | https://colleges.agentexchange.work/leads/no-hsts/state/KS.csv · card $9 |
| Arizona (report) | 39 | 50.6% | https://colleges.agentexchange.work/leads/no-hsts/state/AZ.csv · card $9 |
| Colorado (report) | 37 | 52.9% | https://colleges.agentexchange.work/leads/no-hsts/state/CO.csv · card $9 |
| Iowa (report) | 35 | 52.2% | https://colleges.agentexchange.work/leads/no-hsts/state/IA.csv · card $9 |
| Wisconsin (report) | 35 | 49.3% | https://colleges.agentexchange.work/leads/no-hsts/state/WI.csv · card $9 |
| Minnesota (report) | 34 | 39.5% | https://colleges.agentexchange.work/leads/no-hsts/state/MN.csv · card $9 |
| Arkansas (report) | 32 | 42.1% | https://colleges.agentexchange.work/leads/no-hsts/state/AR.csv · card $9 |
| Mississippi (report) | 32 | 66.7% | https://colleges.agentexchange.work/leads/no-hsts/state/MS.csv · card $9 |
| Oregon (report) | 31 | 53.4% | https://colleges.agentexchange.work/leads/no-hsts/state/OR.csv · card $9 |
| Utah (report) | 27 | 52.9% | https://colleges.agentexchange.work/leads/no-hsts/state/UT.csv · card $9 |
| West Virginia (report) | 27 | 44.3% | https://colleges.agentexchange.work/leads/no-hsts/state/WV.csv · card $9 |
| Connecticut (report) | 25 | 56.8% | https://colleges.agentexchange.work/leads/no-hsts/state/CT.csv · card $9 |
| New Mexico (report) | 25 | 65.8% | https://colleges.agentexchange.work/leads/no-hsts/state/NM.csv · card $9 |
| Maryland (report) | 23 | 35.9% | https://colleges.agentexchange.work/leads/no-hsts/state/MD.csv · card $9 |
| Maine (report) | 22 | 66.7% | https://colleges.agentexchange.work/leads/no-hsts/state/ME.csv · card $9 |
| New Hampshire (report) | 16 | 55.2% | https://colleges.agentexchange.work/leads/no-hsts/state/NH.csv · card $9 |
| Idaho (report) | 15 | 60.0% | https://colleges.agentexchange.work/leads/no-hsts/state/ID.csv · card $9 |
| Hawaii (report) | 14 | 60.9% | https://colleges.agentexchange.work/leads/no-hsts/state/HI.csv · card $9 |
| Nebraska (report) | 14 | 35.0% | https://colleges.agentexchange.work/leads/no-hsts/state/NE.csv · card $9 |
| North Dakota (report) | 13 | 56.5% | https://colleges.agentexchange.work/leads/no-hsts/state/ND.csv · card $9 |
| South Dakota (report) | 13 | 52.0% | https://colleges.agentexchange.work/leads/no-hsts/state/SD.csv · card $9 |
| Nevada (report) | 12 | 57.1% | https://colleges.agentexchange.work/leads/no-hsts/state/NV.csv · card $9 |
| District of Columbia (report) | 11 | 52.4% | https://colleges.agentexchange.work/leads/no-hsts/state/DC.csv · card $9 |
| Montana (report) | 10 | 37.0% | https://colleges.agentexchange.work/leads/no-hsts/state/MT.csv · card $9 |
| DE | 8 | — | https://colleges.agentexchange.work/leads/no-hsts/state/DE.csv · card $9 |
| VT | 7 | — | https://colleges.agentexchange.work/leads/no-hsts/state/VT.csv · card $9 |
| AK | 6 | — | https://colleges.agentexchange.work/leads/no-hsts/state/AK.csv · card $9 |
| WY | 6 | — | https://colleges.agentexchange.work/leads/no-hsts/state/WY.csv · card $9 |
| RI | 5 | — | https://colleges.agentexchange.work/leads/no-hsts/state/RI.csv · card $9 |
| GU | 2 | — | https://colleges.agentexchange.work/leads/no-hsts/state/GU.csv · card $9 |
| AS | 1 | — | https://colleges.agentexchange.work/leads/no-hsts/state/AS.csv · card $9 |
| FM | 1 | — | https://colleges.agentexchange.work/leads/no-hsts/state/FM.csv · card $9 |
| MH | 1 | — | https://colleges.agentexchange.work/leads/no-hsts/state/MH.csv · card $9 |
| MP | 1 | — | https://colleges.agentexchange.work/leads/no-hsts/state/MP.csv · card $9 |
| VI | 1 | — | https://colleges.agentexchange.work/leads/no-hsts/state/VI.csv · card $9 |
Free: the first 50 of 2,622 (alphabetical)
| Domain | Control and level | State | IPEDS sector | Census record |
|---|---|---|---|---|
| 4cd.edu Contra Costa Community College District Office | public 2-year | CA | Administrative Unit | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no |
| aabeautycollege.com Asian-American International Beauty College | private for-profit less-than-2-year | CA | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| aada.edu American Academy of Dramatic Arts-Los Angeles | private nonprofit 2-year | CA | Private not-for-profit, 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no |
| aahctn.edu Academy of Allied Health Careers | private for-profit less-than-2-year | TN | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot allowed |
| aamu.edu Alabama A & M University | public 4-year | AL | Public, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility yes |
| aati.edu American Advanced Technicians Institute | private for-profit less-than-2-year | FL | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| abac.edu Abraham Baldwin Agricultural College | public 4-year | GA | Public, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility yes |
| abc.edu Appalachian Bible College | private nonprofit 4-year | WV | Private not-for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot blocked |
| abcnash.edu American Baptist College | private nonprofit 4-year | TN | Private not-for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot allowed |
| abcotechnology.edu ABCO Technology | private for-profit 2-year | CA | Private for-profit, 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| abcott.edu Abcott Institute | private for-profit less-than-2-year | MI | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| abuacademy.com A Better U Beauty Barber Academy | private for-profit less-than-2-year | NM | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| academyart.edu Academy of Art University | private for-profit 4-year | CA | Private for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot allowed |
| academycollege.edu Academy College | private for-profit 4-year | MN | Private for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| academydicapelli.com Academy Di Capelli-School of Cosmetology | private for-profit less-than-2-year | CT | Private for-profit, less-than 2-year | HTTP 202 · HSTS no · security.txt none · privacy no · accessibility no |
| academynursing.com Mifflin County Academy of Science and Technology | public less-than-2-year | PA | Public, less-than 2-year | HTTP 521 · HSTS no · security.txt none · privacy no · accessibility no |
| academyofbeautyprofessionals.com Academy of Beauty Professionals | private for-profit less-than-2-year | MO | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| academyofhair.com Academy of Hair Design-Grenada | private for-profit less-than-2-year | MS | Private for-profit, less-than 2-year | HTTP 202 · HSTS no · security.txt none · privacy no · accessibility no |
| academyofsalonprofessionals.com Academy of Salon Professionals | private for-profit less-than-2-year | MO | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot allowed |
| academysalonspa.com Academy of Salon and Spa | private for-profit less-than-2-year | AR | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| acaom.edu American College of Acupuncture and Oriental Med | private for-profit 4-year | TX | Private for-profit, 4-year or above | HTTP 202 · HSTS no · security.txt none · privacy no · accessibility no |
| acbebeautycollege.com Academy of Cosmetology, Barbering, and Esthetics | private for-profit less-than-2-year | OK | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot allowed |
| accesscareers.net Access Careers | private for-profit less-than-2-year | NY | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| acchs.edu Academy of Chinese Culture and Health Sciences | private nonprofit 4-year | CA | Private not-for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| accsuccess.com Advanced College of Cosmetology | private for-profit less-than-2-year | WI | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot allowed |
| acecareer.edu Ace Institute of Technology | private for-profit 2-year | NY | Private for-profit, 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| ach.edu American College of Healthcare and Technology | private for-profit 2-year | CA | Private for-profit, 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| achehealth.edu Arkansas Colleges of Health Education | private nonprofit 4-year | AR | Private not-for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| achs.edu American College of Healthcare Sciences | private for-profit 4-year | OR | Private for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot allowed |
| aci.edu Advantage Career Institute | private for-profit less-than-2-year | NJ | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot allowed |
| acom.edu Alabama College of Osteopathic Medicine | private nonprofit 4-year | AL | Private not-for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility yes · GPTBot partly blocked |
| acp.edu Appalachian College of Pharmacy | private nonprofit 4-year | VA | Private not-for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| acphs.edu Albany College of Pharmacy and Health Sciences | private nonprofit 4-year | NY | Private not-for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot allowed |
| acs.edu Alliance Computing Solutions | private for-profit less-than-2-year | NY | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot allowed |
| acs350.org Assumption College for Sisters | private nonprofit 2-year | NJ | Private not-for-profit, 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| actx.edu Amarillo College | public 2-year | TX | Public, 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| acupressureschool.com East-West Healing Arts Institute | private for-profit less-than-2-year | WI | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| acupunctureschoolusa.com American Academy of Health and Wellness | private for-profit 4-year | MN | Private for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| adrians.edu North Adrian's College of Beauty Inc | private for-profit less-than-2-year | CA | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| adtecpr.com Advantage Technical College | private for-profit less-than-2-year | PR | Private for-profit, less-than 2-year | HTTP 200 via adtec.edu · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| advanced.edu Advanced Career Institute | private for-profit less-than-2-year | CA | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| affinityhairacademy.com Affinity Hair Academy | private for-profit less-than-2-year | FL | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| agmedtech.com Aguilas International Technical Institute | private for-profit less-than-2-year | FL | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| agnesscott.edu Agnes Scott College | private nonprofit 4-year | GA | Private not-for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| agora.edu Agora University | private nonprofit 4-year | VA | Private not-for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot allowed |
| aguadilla.inter.edu Inter American University of Puerto Rico-Aguadilla | private nonprofit 4-year | PR | Private not-for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no |
| ahci.edu Allied Health Careers Institute | private for-profit less-than-2-year | TN | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| ahn.org Citizens School of Nursing | private nonprofit 2-year | PA | Private not-for-profit, 2-year | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| ahwbarberacademy.com Adrian H. Wallace Barber Academy | private for-profit less-than-2-year | FL | Private for-profit, less-than 2-year | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| aiam.edu American Institute of Alternative Medicine | private for-profit 4-year | OH | Private for-profit, 4-year or above | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot allowed |
The same rows as JSON: no-hsts.top.json (CORS open, cached one day).
Get the full list: 2,622 rows, 1.00 USDC
x402 on Base, paid per file, no account or key. GET https://colleges.agentexchange.work/leads/no-hsts.csv or GET https://colleges.agentexchange.work/leads/no-hsts.json answers 402 Payment Required with the terms (scheme exact, USDC on Base, maxAmountRequired 1000000, payTo 0xc91cE6291eDC0713ec753BAFBA002506ffb2b95c); an x402 client signs the EIP-3009 authorization and resends the same request with X-PAYMENT; the file comes back with a PAYMENT-RESPONSE header. HEAD gets the same 402. One state: GET https://colleges.agentexchange.work/leads/no-hsts/state/<code>.csv, 0.25 USDC (codes in the table above).
curl -sS -D - https://colleges.agentexchange.work/leads/no-hsts.csv # 402 with the x402 terms; pay and resend with X-PAYMENT
Columns (19): domain, name, type, city, state, ipeds_sector, reachable, http_only, https_status, final_host, hsts, security_txt, privacy_link, accessibility_link, robots_gptbot, robots_chatgpt_user, robots_claude_user, llms_txt, title. CSV: header row, every cell quoted, yes/no for booleans. JSON: { list, title, count, by_state, columns, rows[][] }. Sizes: CSV 649 KB, JSON 659 KB. The same facts are in the free CC BY 4.0 dumps: the price buys the filtered, state-sliceable file built from the 2026-09-30 census, not exclusive data. Settlement is final; no refunds. Prices in /.well-known/x402 equal the challenges. Terms · pricing.
Card checkout
Pay with a card through Stripe and get the file on the next page: Full list CSV, $29 · JSON, $29 · one state $9 (links in the table below) · all 8 lists, $79. Agents pay less with x402 (see above).
Monitor this list (free)
Atom feed: colleges that entered or left this list according to the live re-checks (every 6 hours a rotating slice, each domain at most once per 14 days; each entry says which way it moved and which field changed). no-hsts.top.json: the first 50 rows and the counts by state as JSON, CORS open. Fields watched: hsts.
Membership reflects the homepage and well-known files as fetched on 2026-09-30: a control that exists but was not found where the census looked counts as missing, and sites answering 403 to our one polite request count as reachable. Every domain links to its record with what to fix, a JSON twin, a badge and a changes feed. Data licence CC BY 4.0. Not legal advice.