Security headers on the world's top 1,000 websites

Key findings

• Only 22.4% of the sites send all four basic protections (HSTS, X-Content-Type-Options, frame protection and Referrer-Policy).
• 69.0% send HSTS, so about 3 in 10 popular sites still let a first visit happen over plain HTTP. 38 of the 372 HSTS policies use a max-age under six months.
• 50.6% send an enforced Content-Security-Policy. Of the 172 policies that control scripts, 94 still allow inline scripts without a nonce or strict-dynamic, which weakens XSS protection.
• 22 sites send a CSP only in report-only mode, so it is monitored but not enforced.
• 84 sites (15.6%) send none of the seven headers we checked.
• Referrer-Policy (28.4%), Permissions-Policy (15.4%) and Cross-Origin-Opener-Policy (10.4%) are the least adopted.
• 477 of 534 sites (89%) redirect plain HTTP straight to HTTPS.
• The very largest sites do better on HSTS (83% in the top 100) but no better on the full set of basics (24%).

Adoption by header

By rank band

"All 4 basics" means HSTS, X-Content-Type-Options, a frame protection (X-Frame-Options or CSP frame-ancestors) and Referrer-Policy.

Method

On 2026-10-19 we requested https://<domain>/ for each of the top 1,000 domains in the Tranco list of 2026-10-18 (list ID 467YX), following redirects, and recorded the response headers of the final page. 461 domains did not return a page with a status below 400, mostly CDN, API and tracking domains that serve no homepage, or sites that block automated requests; they are excluded, leaving 539 sites. We also requested http://<domain>/ without following redirects to see whether it redirected to HTTPS. Only the homepage was checked; inner pages can differ. A header counts as present if it is sent with any non-empty value.

You are welcome to cite or reuse these figures with a link to this page (CC BY 4.0).