Defaults.Exposed › Stats › Web security headers

Web security headers

7 statistics · figures as of September 5, 2026 · census snapshot 2026-09-05 · September 2026 edition

The cheapest controls the census measures, and the ones fewest sites bother to send.

Security headers cost one line of server or CDN configuration each, apply to every page at once, and require no code change. Adoption is nevertheless the lowest of anything the census measures. 10.1% of graded domains send an effective Content-Security-Policy. 15.3% send clickjacking protection. 17.8% send X-Content-Type-Options. 7.9% set a Referrer-Policy.

Read those four together and the pattern is clear: the simplest header is the most adopted and the most powerful is the least. Content-Security-Policy is the header that meaningfully constrains what a compromised page can do, and it is also the one that takes thought to write and can break a site if written carelessly. X-Content-Type-Options has one correct value and breaks nothing. Adoption tracks effort almost perfectly, and inversely with protection.

The combined figure is the one worth remembering. Only 1,384,815 domains, 1.2% of everything graded, pass every security-header check at once. Headers are not individually decisive and were never meant to be; they are a set of narrow doors, and closing three of four leaves the fourth open. Passing all of them is what a deliberately configured site looks like, and almost nothing is deliberately configured.

The reason adoption stays this low is that nothing visibly breaks when these headers are absent. No user complains, no monitor alerts, no page fails to load. The cost of omission is entirely conditional: it only materialises when something else has already gone wrong, and then it decides how far the damage travels.

If only one of these is ever going to be added, the order is not the one most people guess. X-Content-Type-Options has a single correct value, cannot break a working site, and closes a real class of attack, so it is the free one. Clickjacking protection is nearly as safe and stops your pages being framed inside somebody else's. Referrer-Policy costs nothing and stops URLs leaking to third parties. Content-Security-Policy comes last, not because it matters least but because it is the only one that needs testing against a real site before it goes live.

The other lever is the content delivery network. Most sites sending these headers are not setting them in application code; their CDN or hosting platform is adding them. That is also why adoption can jump without anyone publishing advice: one provider changes a default and a percentage point of the web moves overnight. If your site sits behind a CDN, these four controls are usually a toggle in a dashboard rather than a deployment.

Four headers, one line each, no downtime. The scan lists which are missing and gives you the exact lines to add.

← All sections · how we grade · data & downloads