Cybersecurity glossary
What is Expect-CT?
Learn what the Expect-CT HTTP header was, how it requested Certificate Transparency enforcement and reporting, why browsers deprecated it, and what defenders should use instead today.
Definition
Expect-CT was an HTTP response header that asked browsers to enforce Certificate Transparency requirements for a site’s certificates and optionally report CT failures, a role largely superseded when browsers began requiring CT by default for publicly trusted certificates.
Why Expect-CT existed
Before Certificate Transparency was universally enforced by browsers for publicly trusted certificates, site operators wanted a way to opt into stricter CT behavior and learn about failures. Expect-CT provided that signal through an HTTP response header.
It mattered during a transition period: organizations could enable reporting, then enforcement, and discover certificate or CDN misconfigurations that lacked proper SCTs. Once browsers required CT by default, the header’s unique value largely disappeared.
How Expect-CT worked
Site sends Expect-CT
HTTPS responses included Expect-CT with a max-age and optional enforce or report-uri directives.
Browser stores policy
Compatible browsers remembered the Expect-CT policy for the host for the max-age duration.
Later connections evaluate CT
On subsequent visits, the browser checked whether the certificate met CT requirements.
Report or enforce
Failures could generate reports to a URI, and enforce mode could block non-compliant certificates.
Operators fix issuance issues
Missing SCTs or non-compliant certificates were corrected at the CA or TLS terminator.
Browser CT becomes baseline
As CT enforcement became default, Expect-CT was deprecated and removed from modern browsers.
Header concepts (historical)
max-age
How long the browser should remember the Expect-CT policy for the host.
enforce
Optional directive requesting rejection of connections that failed CT requirements.
report-uri
Endpoint that received JSON reports about CT failures for troubleshooting.
Expect-CT vs lasting controls
| Control | Status today | Purpose |
|---|---|---|
| Expect-CT | Deprecated / obsolete for new use | Transitional CT enforcement and reporting |
| Browser CT requirements | Active baseline for public certs | Require SCTs for publicly trusted certificates |
| CT log monitoring | Recommended operational practice | Detect unexpected issuance for your domains |
| HSTS | Still recommended | Force HTTPS and reduce downgrade risk |
What to do now
- Do not add Expect-CT to new security header baselines.
- Confirm public certificates come from CT-compliant CAs with valid SCTs.
- Monitor Certificate Transparency logs for unauthorized certificates on your domains.
- Keep HSTS, CSP, and modern TLS configuration as active HTTP security priorities.
- Remove obsolete Expect-CT headers during header cleanup if browsers no longer use them.
- Update internal docs that still list Expect-CT as a required control.
- Treat scanner findings about missing Expect-CT as informational/historical unless policy says otherwise.
- Focus incident response on CT alerts and CA/DNS control-plane security.
The practical takeaway
Expect-CT was a transitional HTTP header for Certificate Transparency enforcement and reporting. Browser-native CT requirements made it unnecessary.
For modern sites, skip Expect-CT. Use CT-compliant certificates, monitor CT logs, and invest effort in controls that still change risk—HSTS, sound TLS, and domain control-plane security.
Related security terms
Certificate Transparency
The logging ecosystem Expect-CT was designed to help enforce and monitor.
HTTP Strict Transport Security (HSTS)
A different HTTP security header that remains widely recommended for HTTPS enforcement.
X.509 Certificate
The certificates whose CT status Expect-CT concerned.
Certificate Authority (CA)
Issuers that submit certificates to CT logs under modern Web PKI expectations.
Frequently asked questions
What is Expect-CT in simple terms?
Expect-CT was a website header that told browsers to be strict about Certificate Transparency for that site and optionally send reports if certificates were not properly logged.
Do I still need the Expect-CT header?
Generally no for new deployments. Major browsers deprecated Expect-CT after making Certificate Transparency a baseline requirement for publicly trusted certificates.
What did Expect-CT enforce?
In enforce mode, browsers could reject connections when CT requirements were not met for the site’s certificate, according to then-current CT policy.
What replaced Expect-CT?
Browser-built-in CT enforcement for public certificates, plus operational CT monitoring by domain owners for unexpected issuance.
Was Expect-CT related to HSTS?
Both are HTTP response headers that influence browser security behavior, but HSTS forces HTTPS usage while Expect-CT concerned Certificate Transparency evidence.
If Expect-CT is obsolete, what should teams do for CT?
Use CT-compliant public CAs, monitor CT logs for your domains, and respond to unexpected certificates. Do not rely on Expect-CT for new security value.
Can Expect-CT still appear in scanners?
Yes. Legacy configurations and header inventories may still show Expect-CT. Treat it as historical unless you have a rare compatibility reason to keep it temporarily.
References
Explore authoritative guidance and frameworks related to expect-ct.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.