Defaults.Exposed › Stats › Web security headers
What percent of websites have a Content-Security-Policy?
October 2026 census edition
As of October 12, 2026, 2.85% of the 222,969,925 domains that sent a Server, Content-Security-Policy or X-Powered-By header in the Defaults.Exposed census carry a Content-Security-Policy that constrains script (a default-src or script-src directive): 6,354,384 domains. 10.45% (23,309,190 domains) send a Content-Security-Policy header of any kind, which includes policies that say nothing about script.
Adoption is quoted as the directive count, as explained in /research/csp-adoption-corrected. The csp-header check in the grade is a separate measure on a different base, the domains whose page returned a 2xx response.
CSP adoption: how it is measured
It comes from the HTTP (Hypertext Transfer Protocol) response pass, which records the headers every reachable host returns and, for Content-Security-Policy, reads the directives inside the policy rather than only noting that a header was sent. Every domain in the census is measured directly and counted once.
Content-Security-Policy is the only header here that meaningfully limits what a compromised page can do. It is also the only one that requires testing against a real site before deployment, because a careless policy breaks working functionality.
Because the figure is a share, the denominator carries the weight: it is the set of domains where this check had something to read. A domain the census could not decide on is recorded as undetermined and left out, never counted as a failure.
It moves when sites add or drop response headers. These are the cheapest controls the census measures, usually one line of server or CDN (Content Delivery Network) configuration. Adoption stays low because a site without them loads and works exactly as it does with them. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see what the headers do.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
| Content-Security-Policy measure | Domains |
|---|---|
| Sent a Server, CSP or X-Powered-By header (the base) | 222,969,925 |
| Sent a CSP header of any kind | 23,309,190 |
| CSP constrains script (default-src or script-src) | 6,354,384 |
| CSP is only upgrade-insecure-requests | 6,782,420 |
CSP adoption: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "What percent of websites have a Content-Security-Policy?" (as of October 12, 2026). https://defaults.exposed/stats/what-percent-of-websites-have-a-content-security-policy
Permalink: https://defaults.exposed/stats/what-percent-of-websites-have-a-content-security-policy · Machine-readable: /stats/s/csp-adoption.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.