29 September
What happened on this date in privacy, anonymity networks and censorship. Every year on the same date we add a new look back and keep the earlier ones as they were.
2026
The site name the padlock doesn't hide
If you browse with Safari on an iPhone, network operators can still see which site you are visiting; in August 2026 a developer reported on Apple's developer forums that Safari still sends the site name in plain text. The padlock in the address bar only means the page content is encrypted, and hiding the site name sent at the start of a connection takes another technology, Encrypted Client Hello (ECH), which Cloudflare made available on all of its plans on 29 September 2023. As of 1 October 2026, sites on Cloudflare's free plan have it on by default, and Chrome uses it by default on desktop and Android. China blocked an earlier version of ECH in July 2020, according to researchers from Geneva, GFW Report and iYouPort, and Russia's telecom regulator has blocked these connections since November 2024. To see which of these protections your browser covers, open Cloudflare's Browser Check page.
Sources
Encrypted Client Hello - the last puzzle piece to privacyCloudflare, 
TLS Encrypted Client Hello (ECH)Chrome Platform Status
119.0 Firefox ReleaseMozilla, 
Enable Encrypted Client Hello (ECH, RFC 9849) by default on iOS/iPadOS — FB24334961Apple Developer Forums
Cloudflare Browser CheckCloudflare
Exposing and Circumventing China's Censorship of ESNIGeneva、GFW Report、iYouPort
Risky Biz News: Russia blocks Cloudflare ECH connectionsRisky Biz News, 
RFC 9849: TLS Encrypted Client HelloRFC Editor