HTTP Security Headers Across the Top 10,000 Domains (August 2026)

These three have been recommended for over a decade and cost one line of server config each, yet none of them reaches two thirds of this sample. HSTS leads, helped by managed platforms and CDNs that send it by default — a large share of these domains have it without anyone deciding to. That also means the figure measures platform defaults as much as deliberate choices.

Of the 4,820 domains sending HSTS, 55.6% extend it to subdomains with includeSubDomains and 35% ask for preload. 78.1% set a max-age of at least six months, the floor the browser preload lists require — a short max-age narrows the window an attacker has to work with but does not close it.

CSP is the one header on this list that can genuinely stop cross-site scripting, and it is also the least adopted of the older three — 37.6% of these domains send an enforced policy. That gap is a fair reflection of cost: the other headers are a line of config, while a useful CSP has to be reconciled with every script the site loads.

Adoption alone also overstates the protection. 32.8% of those policies allow 'unsafe-inline' in script-src, which permits exactly the inline script injection CSP exists to prevent — so roughly one in three of the policies that exist are substantially weakened by their own contents. A further 4.3% of all domains send only a report-only policy, which blocks nothing by design.

It is the same shape as the DMARC finding in our email authentication study, where 29.4% of published records sit at p=none: the mechanism gets deployed, then parked in a state that observes rather than enforces. Retrofitting a strict CSP means removing every inline handler and <script> block or moving to nonces, which is real work — so the policy ships permissive and stays that way.

Adoption drops sharply for anything standardised in the last several years. These headers control what leaks in the Referer string, which browser capabilities a page may use, and whether a page shares a browsing context group with its opener. None of them are hard to set; they simply have not had the decade of scanner nagging and compliance-checklist pressure the older three have.

Only 6.8% of domains set all six, while 20.3% send none at all. The bulk of the web sits in the middle: a couple of headers inherited from a platform default, and nothing chosen deliberately. That middle is where the cheapest security wins on the entire internet are — each missing header is a one-line config change.

Of the 7,949 domains that responded on port 80 at all, 92.9% redirect to HTTPS. The remainder answer the request over an unencrypted connection — which means a first visit, before any HSTS policy is cached, is open to interception. HSTS only protects a browser that has already seen the header once, which is exactly why the preload list exists and why only 35% using it matters.

Read as a rough signal rather than a census: the Server header is trivial to change or suppress, and a CDN in front of an origin reports itself rather than the thing behind it. Suppressing it is mild security-through-obscurity — it slows down automated scanning without stopping anyone determined.