Nearly half of the web's biggest sites send no Content-Security-Policy

We checked the security headers of the 1,000 most visited websites on 14 November 2026. Of the 636 that answered with a page we could read, 45% send no Content-Security-Policy, 36% send no usable HSTS header, and only 11% send a policy that restricts which scripts can run. Three in ten send all four basic protections. Nearly one in five sends none.

Security headers are instructions a website sends to the browser with every page: only load this site over HTTPS, do not let other sites put this page in a frame, only run scripts from these places. They cost nothing and they close whole classes of attack. So we wanted to know how the best-resourced sites on the web use them, and what a smaller site can take from the answer.

We used our free Security Headers Checker on the top 1,000 names of the Tranco list, a research ranking of the most visited sites. Each name got one check of its home page.

What we could read

Of the 1,000 names, 636 answered with a page we could grade. The other 364 are worth a line, because they say something about such lists:

• 220 names have no website at all. They are the addresses of content networks, name servers and app back ends, which rank high because every device talks to them.
• 78 answered our checker with a bot challenge instead of the page. We do not guess what is behind a challenge.
• 66 timed out, dropped the connection, failed the TLS handshake or were declined.

Everything below is a share of the 636.

The four basics are far from universal

Four headers cover the attacks every site faces: HSTS keeps visitors on HTTPS, a Content-Security-Policy limits what an injected script can do, framing protection stops clickjacking, and X-Content-Type-Options: nosniff stops the browser guessing file types.

Protection	Sites that send it
HSTS	64%
Framing protection	62%
nosniff	55%
Content-Security-Policy, enforced	51%

Three in ten sites (30%) send all four. Nearly one in five (18%) sends none.

A policy is not the same as protection

Half of the sites enforce a Content-Security-Policy. Far fewer are protected by it.

A policy’s main job is to stop cross-site scripting, and it only does so when it restricts which scripts may run. Of the 325 policies we read:

• 39% name neither script-src nor default-src. They are used for something else, such as framing rules, and place no limit on scripts.
• 34% allow inline script with no nonce or hash, which is the very thing an attacker injects.
• 39% allow eval.
• 22% allow scripts from any host through a wildcard or a bare https:.

Only 70 sites, 11% of the 636, send a policy that restricts scripts. A further 23 sites run a policy in report-only mode with nothing enforced yet, which is the right way to start.

HSTS: present, often half set

HSTS is the most common of the four, and the detail matters:

• Half of all sites (50%) set it for a year or more. Another 14% set a shorter time.
• Of the sites with HSTS, 45% leave out includeSubDomains, so their subdomains can still be reached over plain HTTP.
• 17% are on the preload list that browsers ship with, the only form that protects a visitor’s very first request.
• On 11% of sites, plain HTTP does not redirect to HTTPS at all.

HSTS is one part of a site’s HTTPS setup. Our guide to checking a TLS configuration covers the rest: protocol versions, cipher suites and the certificate chain.

Cookies

A little over half of the sites (57%) set a cookie on the first response. A third of those put every protective flag on every cookie. Of the sites that set a cookie:

• 63% set a cookie without SameSite. Chromium-based browsers treat such a cookie as Lax; not every browser does.
• 44% set a cookie without Secure.
• 14% set what looks like a session cookie without HttpOnly, so a script on the page can read it.

The newer headers are rare

Header	Sites that send it
Referrer-Policy, with a private value	17%
Permissions-Policy	14%
Cross-Origin-Opener-Policy	8%
Cross-Origin-Resource-Policy	6%

Three sites of the 636 send all four.

One caution about the first row. A site with no Referrer-Policy is not exposed: browsers now apply strict-origin-when-cross-origin by themselves, which keeps the path and query of a page private from other sites. That covers 71% of this list. The real problem is the 11% that set a value which sends other sites more than that default does.

Leftovers

• 26% still switch on X-XSS-Protection, a filter that browsers removed years ago.
• 22% announce their server software or its version in a header.
• 29% publish a security.txt file so that a researcher knows where to report a problem. More than a third of those files have a fault, most often no expiry date.
• Of the 391 sites that load scripts or styles from another origin, 12 put an integrity value on all of them.

And the grades

Our checker turns all of the above into one letter. It counts what a browser will enforce, so a header that is present but ignored earns nothing.

Grade	Sites	Share
A+ or A	0	0%
B	40	6%
C	107	17%
D	153	24%
F	336	53%

No site of the 636 earned an A. The best eight came within five points of one, and most of them were short by the same things: a script policy that could be stricter, and one or two of the newer headers.

Rank helps, up to a point. Among the top 100 names, 35% failed and 18% earned a B. From 501 to 1,000, 56% failed and 3% earned a B.

An A is not out of reach. The same rules give this site an A+, which says more about its size than its merit: one small site, one team, nothing inherited.

What this means for a smaller site

The biggest sites carry years of old pages, third-party tags and teams that each own a part. A small site has none of that, which makes the basics a short job:

1. Redirect plain HTTP to HTTPS and send Strict-Transport-Security: max-age=31536000; includeSubDomains, once every subdomain serves HTTPS.
2. Send X-Content-Type-Options: nosniff.
3. Send Content-Security-Policy: frame-ancestors 'self' or X-Frame-Options: SAMEORIGIN.
4. Put Secure, HttpOnly and SameSite on the session cookie.
5. Start a Content-Security-Policy in report-only mode, read what it reports, then enforce it. This is the one that takes care.

The first four take minutes and already put a site ahead of most of this list. Our Security Headers Checker shows which of these a site sends and gives the lines to add for the common servers and hosts.

How we measured

• The list: Tranco, as downloaded on 14 November 2026, the first 1,000 names.
• One request per name: the home page of the name as listed, followed through its redirects, from one location in the United States. The final response was read.
• A site can send different headers on other pages, to other countries, or to a signed-in visitor. This is a snapshot of one page on one day.
• Names that are not websites, and sites that challenged or refused the check, are counted as not read and are in none of the percentages.
• We name no site. One request from one place is not a fair basis for calling out a company.
• The grades are those of version 1.1 of our rules, applied to the responses recorded on that day. The rules are published with the checker. This list was also the test of the rules themselves: it showed where the first version charged the same weakness twice, and the changelog lists what we corrected before publishing these grades.