Website traffic
How much traffic does haveibeenpwned.com get?
3.74M
-7.43%MoMEstimated monthly visits
4.94M3.3M1.65M0
Global rank
16,756
Country rank · United States
15,663
Category rank · Computers Electronics and Technology
408
Average visit duration
01:14
Pages per visit
2.38
Bounce rate
52.67%
Domain age
13 years
Search share
55.7%
Sources
Where does haveibeenpwned.com's traffic come from?
- Search55.7%
- Direct32.3%
- Referrals4.3%
- Social3.1%
- Generative AI2.8%
- Email1.6%
- Display ads0.1%
- Paid search0.0%
- Other0.0%
Regions
Which countries visit haveibeenpwned.com?
- United States19.0%
- Germany9.1%
- India7.5%
- France5.9%
- United Kingdom5.1%
See how haveibeenpwned.com compares with the most visited websites in the world, the fastest growing websites and sites gaining organic search traffic.
Search visibility
What keywords send traffic to haveibeenpwned.com?
Keyword samples
Estimated visitsMonthly searchesVisits ÷ searches
- have i been pwnedBRAND639.78K291.05K220%
- haveibeenpwnedBRAND353.98K207.61K171%
- pwnedBRAND29.13K24.26K120%
- i have been pwnedBRAND26.42K10.74K246%
- have i been pawnedBRAND13.48K9.47K142%
Keyword rankings
Keyword rankings
86.4M
Search estimate
New 1 · Up 2
- Ranking keywords
- 12,400
- Landing pages
- 4
- Search competitors
- 4
- AI citations
- 2
PositionEstimated visits
- google#142M
- gmail#118.2M
- google maps#19.4M
- google drive#14.1M
Full keyword rankings are a Pro feature
Unlock ProSite profile
What does haveibeenpwned.com show publicly?
- HTTP 200
- Email authentication
- Hosting ASN
- DNSSEC
- HTTP
- 200
- Page size
- 27.0 KiB
- Hosting
- CLOUDFLARENET · AS13335
- Email authentication
- SPF · DMARC reject
- TLS
- TLSv1.3 · 87 days
Page and SEOSchema 7
- Final URL
- https://haveibeenpwned.com/
- Title
- Have I Been Pwned: Check if your email address has been exposed in a data breach
- Description
- Have I Been Pwned (HIBP) is a data breach search and notification service used by security teams, developers, and MSPs worldwide. Search tens of billions of breached records, monitor corporate domains via API, and get alerted when new breaches appear.
- Cross-origin redirect
- No
- Word count
- 264
- Internal / external links
- 20 / 8
- Canonical
- https://haveibeenpwned.com/
- Language
- en
- H1 / H2
- 0 / 1
- Images missing alt
- 0 / 4
- Schema
- Audience · CreativeWork · Offer · Organization · Person · SoftwareApplication · 1 more
- OG / Twitter
- OG · Twitter
- Feed / Manifest / AMP
- Feed · Manifest
Technology and tracking1 tracking
- Technology clues
- Cloudflare · Bootstrap · Bot protection
- Tracking clues
- Cloudflare Web Analytics
- External script hosts
- challenges.cloudflare.com · static.cloudflareinsights.com
- Social links
- x.com · facebook.com · linkedin.com · github.com · bsky.app
- Server
- cloudflare
- Security headers
- 6 / 6
- HSTS / CSP
- HSTS · CSP
- Alt-Svc
- Set
- Cookie
- 1（Secure 1）
Email and DNS securitySet
- SPF
- Set
- DMARC
- Set · reject
- MTA-STS / BIMI
- BIMI
- DKIM selectors
- s1 · s2
- IPv6
- AAAA present
- DNSSEC
- DNSKEY · AD
- CAA issuers
- comodoca.com · digicert.com · letsencrypt.org · pki.goog · 1 more
- Site verification TXT
- SOA
- leah.ns.cloudflare.com
- NS
- rob.ns.cloudflare.com. · leah.ns.cloudflare.com.
- MX
- 10 mxa.mailgun.org. · 10 mxb.mailgun.org.
Hosting and networkAS13335
- A
- 104.16.123.33 · 104.16.124.33
- AAAA
- 2606:4700::6810:7b21 · 2606:4700::6810:7c21
- Hosting ASN
- AS13335 · 104.16.112.0/20
- Hosting organization
- CLOUDFLARENET - Cloudflare, Inc.
- Hosting country
- US
- BGP announcement
- Yes
- TLS
- TLSv1.3 · Verified
- Certificate issuer
- WE1
- Certificate remaining
- 87 days
- Certificate SAN
- DNS:haveibeenpwned.com · DNS:cloudflare-prometheus-exporter.haveibeenpwned.com
robots and AI crawlingHTTP 200
- Robots.txt
- 200
- Global Disallow /
- No
- Sitemap
- URL set · 1,061
- AI explicitly disallowed
- 0
- AI explicitly allowed
- 0
Well-known public paths1 hits
- Present / checked
- 1 / 5
- /.well-known/security.txt
- Present · 815 B
- security summary
- Contact: mailto:security@troyhunt.com · Contact: https://twitter.com/troyhunt · Encryption: https://keybase.io/troyhunt
Website information
When was haveibeenpwned.com registered?
- Domain
- haveibeenpwned.com
- Registration status
- Domain registered
- Registered
- 2013-11-13
- Registrar
- 1API GmbH
- Expires
- 2034-11-13
- Domain age
- 13 years
- DNSSEC
- Yes
- Registry status
- client transfer prohibited
Similar sites
What sites are similar to haveibeenpwned.com?
Website reports in the same category, with nearby monthly visits.
What's in this report
The report starts with a whole-site monthly visit estimate. Search visibility and public site facts follow when they exist.
- Website traffic is a modeled whole-site estimate, with a source, observation period and confidence.
- Search visibility is ranking keywords and search traffic, listed separately from whole-site visits.
- Missing or partial values stay marked in the report.