Expect-CT Is Deprecated — What to Use Instead in 2026

Updated April 2026

Expect-CT appears in a lot of security header guides written between 2018 and 2021. Those guides are outdated. The header was removed from the spec, ignored by all modern browsers, and is now just dead weight in your response headers.

Quick check — remove it if you have it

# Check if you are sending Expect-CT
curl -I https://yoursite.com/ | grep -i expect-ct
# If it appears — remove it from your config. It does nothing.

Remove by stack

Nginx — remove from nginx.conf

# Delete this line if you have it:
add_header Expect-CT "max-age=86400, enforce, report-uri=https://yoursite.com/ct-report";

Helmet (Express) — it has already removed it

# Helmet stopped including Expect-CT in version 5.0 (2021)
# If you are on Helmet 5+ you are fine
# If on an older version: upgrade
npm install helmet@latest

Vercel / Netlify headers files — delete the line

# Remove from vercel.json headers or _headers file:
# { "key": "Expect-CT", "value": "..." }  ← delete this

What CT looks like today (no header needed)

Certificate Transparency now works like this:

1. You obtain a TLS certificate from your CA (Let's Encrypt, DigiCert, etc.)
2. The CA automatically submits it to multiple public CT logs
3. Chrome and other browsers check CT compliance using embedded log lists — not your header
4. If your certificate is not CT-logged, browsers show an error regardless of what headers you send

What you should have instead of Expect-CT

# These are the headers that actually matter for HTTPS security in 2026:

# HSTS — tells browsers to always use HTTPS
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

# CSP — controls which resources load
Content-Security-Policy: default-src 'self'; ...

# The rest of your security headers checklist
# Expect-CT is not on any of them — correctly