Defaults.Exposed › Stats › Web security headers
What percent of websites have a Content-Security-Policy?
As of July 28, 2026 · census snapshot 2026-07-28
As of July 28, 2026, 3.8% of the 276 million domains graded in the Defaults.Exposed census send an effective Content-Security-Policy header — 10,409,054 domains.
Cite this
Statistic current as of July 28, 2026. Recomputed from the live census each edition; the number on this page and the machine-readable twin always match. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "What percent of websites have a Content-Security-Policy?" (as of July 28, 2026). https://defaults.exposed/stats/what-percent-of-websites-have-a-content-security-policy
Permalink:https://defaults.exposed/stats/what-percent-of-websites-have-a-content-security-policy · Machine-readable:csp-adoption.json · Licence:open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.
Related statistics
- What percent of websites block clickjacking?
- What percent of websites set X-Content-Type-Options?
- What percent of websites set a Referrer-Policy?
- How many websites pass every security-header check?
- How many websites use cross-origin isolation headers?
- How many websites deploy HTTPS, HSTS and CSP together?