Defaults.Exposed › October 2026 census › v10 registry › Content-Security-Policy
Content-Security-Policy
Methodology v10 · canonical ID csp-header · Web Security · scored
Reduces the chance a hacked or injected script steals customer data off your site.
Content-Security-Policy: definition
| Canonical ID | csp-header |
|---|---|
| Category | Web Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The site sends an effective Content-Security-Policy header. |
| Fail | No CSP header is sent. |
| Example (passing) | Content-Security-Policy: default-src 'self' |
Content-Security-Policy across the census
2.85% of domains that sent a Server, Content-Security-Policy or X-Powered-By header carry a Content-Security-Policy that constrains script (a default-src or script-src directive) (6,354,384 of 222,969,925, as of October 12, 2026).
23,309,190 of the same 222,969,925 domains (10.45%) send a Content-Security-Policy header of any kind, including policies that say nothing about script. The csp-header check itself runs on a different base: of the 132,559,479 domains whose page returned a 2xx response, 13,777,043 (10.39%) sent a CSP header the check passes. Redirects, errors and unanswered fetches return N/A for the four response-header checks and are never counted as a failure.
Aggregates only: never an individual domain's result.
How this check is scored
Content-Security-Policy is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 199,932,840 of the 332,492,319 graded domains had no determinable result for this check: the four response-header checks run only where the page returned a 2xx response; redirects, errors and unanswered fetches return N/A.
Every outcome in the census
| Outcome | Domains | Share of domains whose page returned a 2xx response | In the headline figure |
|---|---|---|---|
| Sends a CSP header the check passes | 13,777,043 | 10.4% | Yes |
| No CSP header | 118,782,436 | 89.6% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026. Shares are of 132,559,479 domains whose page returned a 2xx response.
By top-level domain
This splits the check’s own pass rate (a CSP header the check passes, over domains whose page returned a 2xx response) by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 89,943,208 domains | 10.7% | .shop 23.0%, .store 15.3%, .art 12.5% | .xyz 1.82%, .top 2.66%, .bet 3.27% |
| Country-code TLDs (ccTLDs): 167 TLDs, 42,370,451 domains | 9.65% | .in 30.7%, .lt 26.4%, .ar 25.9% | .cn 1.37%, .xn--p1ai 1.80%, .ru 3.23% |
The largest TLD in this base, .com, stands at 12.1% (7,046,690 of 58,295,711).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 132,313,659 of the 132,559,479 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 6 Web Security checks with a published figure, Content-Security-Policy has the 6th highest pass share. Next above it is Referrer-Policy: 8.86% of domains whose page returned a 2xx response. Across every check with a published figure it ranks 23rd of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
What the policies that are sent contain
Of the 23,309,190 domains that send a Content-Security-Policy header of any kind, 6,782,420 (29.1%) send a policy whose only directive is upgrade-insecure-requests, which does not restrict script. 5,218,901 (22.4%) allow 'unsafe-inline' and 3,428,528 (14.7%) allow 'unsafe-eval'. 181,921 (0.78%) name a reporting endpoint.
Further reading: Most Content-Security-Policy headers are not content security policies
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix Content-Security-Policy
Cite this check
Defaults.Exposed, "Content-Security-Policy (csp-header)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/csp-header
Permalink: https://defaults.exposed/methodology/csp-header ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data