Defaults.Exposed › Stats › Web security headers

Web security headers

6 statistics · figures as of November 2, 2026 · census snapshot 2026-11-02 · November 2026 edition

The cheapest controls the census measures, and the ones fewest sites bother to send.

Security headers cost one line of server or CDN (Content Delivery Network) configuration each, apply to every page at once, and require no code change. Adoption is nevertheless the lowest of anything the census measures. Of the 222,553,676 domains that sent a Server, CSP or X-Powered-By header, 3.08% send a Content-Security-Policy that constrains script, and 10.82% send a CSP header of any kind. Of the domains whose page returned a 2xx response, 16.7% send clickjacking protection. 19.5% send X-Content-Type-Options. 9.7% set a Referrer-Policy.

Taken together, those four show the simplest header is the most adopted and the most powerful the least. Content-Security-Policy is the header that meaningfully constrains what a compromised page can do, and it is also the one that takes thought to write and can break a site if written carelessly. X-Content-Type-Options has one correct value and breaks nothing.

The combined figure is the one worth remembering. Only 2,044,650 domains, 1.8% of the domains that served a web page and could be checked for every header, pass every security-header check at once.

The reason adoption stays this low is that a site without these headers loads and works exactly as it does with them, so no user or monitor ever reports the gap. The cost of omission is entirely conditional: it only materialises when something else has already gone wrong, and then it decides how far the damage travels.

If you add these one at a time, this is the order. X-Content-Type-Options has a single correct value, cannot break a working site, and closes a real class of attack, so it is the free one. Clickjacking protection is nearly as safe and stops your pages being framed inside somebody else's. Referrer-Policy costs nothing and stops URLs leaking to third parties. Content-Security-Policy comes last because it is the only one that needs testing against a real site before it goes live.

The other lever is the content delivery network. Most sites sending these headers are not setting them in application code; their CDN or hosting platform is adding them. That is also why adoption can jump without anyone publishing advice: one provider changes a default and a percentage point of the web moves overnight. If your site sits behind a CDN, these four controls are usually a toggle in a dashboard rather than a deployment.

Each of the four headers is one line of configuration and needs no downtime. The scan lists which are missing and gives you the exact lines to add.

← All sections · how we grade · data & downloads