Secure by Default: the Server Software Security Showdown
Published
Figures as of 16 August 2026 · methodology v9. This is a recurring report; each edition re-measures the same population so the numbers can be tracked over time. All figures are aggregate — we never publish an individual business’s grade or name an individual registrant’s domain.
The headline: 95.9% versus 7.0%
A website served by Netlify sends the HSTS security header 95.9% of the time. A website served by Apache sends it 7.0% of the time — a 13.7× gap in what users get without anyone lifting a finger. We read the Server header on 191.7 million web responses from the August 2026 census and asked one question of each software family: when this thing answers the internet, how often does the response carry basic protective headers?
The answer splits the web into two tiers. It is not the split most people expect.
Key numbers
- 191,715,808 of 376,928,781 HTTP responses (50.9%) announce their server software in a
Serverheader; the top 30 families cover 96.7% of those. - Apache sends HSTS on 7.0% of its 31.3M sites. Nginx manages 25.5% of 35.8M. The two workhorses of the self-hosted web leave most of their users without it.
- Netlify sends HSTS on 95.9% of responses, Vercel on 94.2%, Squarespace on 83.6% — managed platforms ship the header for you.
- Wix’s edge (the
pepyakaserver string) sends X-Content-Type-Options on 100.0% of its 7.87M responses — one platform decision, 7.87 million sites protected at once. - Caddy, the server famous for automatic HTTPS, sends HSTS on just 14.6% of its 1.94M sites — secure transport by default, but not secure headers.
- Content-Security-Policy is rare everywhere: the best adoption in the top tier is 47.6% (Hostinger’s
hcdn); most families sit below 10%.
What does “secure by default” mean here?
Three response headers, all free, all one config line, all externally observable.
HSTS (Strict-Transport-Security) tells a browser to refuse plain-HTTP connections to the site from now on. It closes the window where a user on hostile Wi-Fi can be downgraded to an unencrypted connection. CSP (Content-Security-Policy) restricts where scripts and other content may load from, which is the strongest browser-side defence against injected script. X-Content-Type-Options (nosniff, XCTO for short) stops browsers from second-guessing file types, killing a whole class of content-confusion tricks.
None of these depends on the site’s code. They are delivered by whatever software answers the HTTP request, which means they can be defaulted by that software or by the platform operating it. That makes them a clean probe of a question vendors rarely get measured on: what do your users end up with when they do nothing?
So we grouped every graded response by the first word of its Server header and counted.
Which server software sends security headers most often?
The table below shows the largest families, sorted by HSTS rate. Percentages are of that family’s own response count.
| Server family | Responses | HSTS | CSP | XCTO |
|---|---|---|---|---|
| Netlify | 1,239,851 | 95.9% | 3.1% | 14.5% |
| Vercel | 3,492,060 | 94.2% | 3.7% | 6.7% |
| Squarespace | 8,751,286 | 83.6% | 0.0% | 40.2% |
Wix edge (pepyaka) | 7,865,007 | 67.1% | 0.0% | 100.0% |
Google (google) | 396,837 | 47.2% | 29.4% | 13.7% |
| nginx | 35,784,836 | 25.5% | 5.5% | 14.2% |
| Cloudflare | 41,854,886 | 23.8% | 16.4% | 28.9% |
| OpenResty | 12,380,670 | 17.5% | 9.8% | 19.8% |
| Caddy | 1,938,092 | 14.6% | 1.0% | 17.0% |
| GitHub Pages | 676,683 | 13.4% | 6.7% | 0.0% |
Hostinger CDN (hcdn) | 5,076,102 | 10.2% | 47.6% | 11.0% |
| Microsoft IIS | 2,441,615 | 7.8% | 2.5% | 6.4% |
| Apache | 31,286,558 | 7.0% | 2.5% | 5.4% |
| LiteSpeed | 9,351,481 | 6.4% | 26.8% | 7.6% |
| Kestrel (.NET) | 3,666,013 | 1.0% | 0.1% | 0.2% |
| AWS ELB | 1,729,501 | 0.3% | 0.1% | 0.3% |
(Platform identifications for pepyaka and hcdn are industry knowledge — those are the Server strings Wix’s and Hostinger’s edges emit — not census data.)
Read down the HSTS column and the pattern is hard to miss. Every family above 60% is a managed platform. Every classic, install-it-yourself server sits below 26%, and Apache — 31.3 million responses, second only to nginx among them — sits at 7.0%. LiteSpeed, the commercial Apache alternative that powers a large slice of shared hosting, does slightly worse at 6.4%. Kestrel, the server behind self-hosted .NET applications, barely registers at 1.0%.
The denominator matters here, so state it plainly: that 7.0% for Apache is 2,191,411 sites with HSTS out of 31,286,558 Apache-fronted responses. The other 29.1 million Apache sites answer the web every day with nothing telling browsers to insist on encryption.
Why do managed platforms win so hard?
Because on a platform, a security header is one decision made once.
When Netlify or Vercel decides its edge should send HSTS, every site on the platform gets it, including the food blog whose owner has never heard the term. When a Wix engineer turned on nosniff at the edge, 7,865,007 sites got it simultaneously, and the census sees a perfect 100.0%. That number is worth staring at. Fleet-wide uniformity like that is impossible in the self-hosted world, where the same protection requires millions of separate administrators to each find the right config file, type the right line, and reload.
Apache and nginx are not worse software. They are unbundled software. They ship as neutral tools, security headers off, and leave the decision to whoever installs them. Most installers never make the decision, because nobody told them there was one to make. The census measures the consequence: the two families that carry the largest share of the announced web, 67.1 million responses between them, protect a quarter of their users at best.
The platform model has a sharp edge, though, and Squarespace shows it. Squarespace’s edge delivers HSTS to 83.6% of its 8.75 million sites, a genuinely good default. Its CSP count across those same 8.75 million responses is one. Not one percent. One response. When the platform decides a header is not worth shipping, essentially no site on it can have one, because the customer does not control the edge. Centralised defaults cut both ways: you inherit the platform’s good calls and you are locked out of the calls it declined to make.
What about Caddy?
Caddy is the interesting miss. It earned its reputation as the secure-by-default web server because it provisions HTTPS certificates automatically, and on that front the reputation is deserved. But HTTPS provisioning is not header policy. Caddy does not emit HSTS unless the operator asks for it, and our measurement shows the result: 14.6% HSTS across 1.94 million Caddy-fronted sites. Better than Apache, worse than nginx, nowhere near the platforms.
The lesson generalises. “Secure by default” is not one property, it is a per-feature choice, and a vendor can default one protection while leaving the next one opt-in. Caddy defaulted transport encryption and its users got it. It left HSTS opt-in and its users, mostly, do not have it. Whatever a vendor defaults, the fleet gets; whatever it leaves opt-in, the fleet skips. On the evidence of 191.7 million responses, that rule has no exceptions worth mentioning.
Is anyone actually sending CSP?
Barely. CSP is the hardest of the three to default, because a wrong policy visibly breaks a site, so platforms and servers alike hesitate to impose one. The column shows it: Netlify and Vercel, HSTS champions both, sit at 3.1% and 3.7% CSP. The self-hosted giants are at 5.5% (nginx) and 2.5% (Apache).
The outliers are worth a look. Hostinger’s CDN layer hits 47.6%, the best CSP rate of any large family. LiteSpeed reaches 26.8% CSP while managing only 6.4% HSTS, an inversion of the usual pattern; LiteSpeed fronts a heavily WordPress-weighted fleet, so application-layer plugins setting CSP are a plausible driver, though our data identifies the serving software, not what set the header behind it. And Google’s own google frontend, serving its various hosted properties, posts 47.2% HSTS and 29.4% CSP, one of the few families strong on both.
Cloudflare deserves its own sentence. At 41.85 million responses it is the single biggest Server string on the web, and its numbers (23.8% HSTS, 16.4% CSP, 28.9% XCTO) are middling. That is expected, and it is a measurement point, not a criticism: Cloudflare is a proxy that mostly passes through whatever the origin behind it chose to send, so its column largely measures its customers, not its defaults.
The two-tier web, in one table
Group the table above by operating model and the finding compresses to this:
| Operating model | Example families | Typical HSTS rate |
|---|---|---|
| Managed platform edge | Netlify, Vercel, Squarespace, Wix | 67% – 96% |
| Self-managed server software | nginx, Apache, LiteSpeed, IIS, Caddy, Kestrel | 1% – 26% |
Same header. Same one line of config. The difference is who has to type it: one platform team, or every site owner individually. Where security ships as a default, adoption is near-total. Where it ships as an option, adoption collapses to the minority who knew to ask.
For a user, the practical meaning is blunt. Whether your connection to a small business is protected against downgrade depends less on how much that business cares about security than on which logo was on the hosting invoice.
How we measured this
- Source: the August 2026 census round, figures as of 16 August 2026, methodology v9. 376,928,781 graded HTTP responses; 191,715,808 of them (50.9%) carried a
Serverheader, and those form the population for this report. The top-30 families analysed here cover 185,469,831 responses, 96.7% of that population. - Grouping: responses were grouped by the first word of the
Serverheader, lowercased.nginx/1.24.0andnginxcount together; distinct strings likeopenrestyandnamecheap-nginxcount separately even where the underlying software is nginx-derived. - What a
Serverstring is: a self-declaration by the front-most thing that answered our request. It can be a proxy or CDN rather than the origin (Cloudflare’s row measures Cloudflare’s customers’ choices), it can be rewritten or spoofed, and behind any string the header may have been set by an application, not the server itself. This report measures ecosystems as delivered to users, not binaries in isolation. - What counts as adoption: presence of the header on the response we captured, one response per domain, fetched from our EU measurement infrastructure. Presence only; a weak CSP and a strict one count the same here (CSP quality is scored separately in the census methodology).
- Vendor framing: every named vendor is identified for measurement context only. A low rate means the fleet running that software mostly has not enabled the header; it is not a statement about the software’s quality or the vendor’s intent. Platform identifications for
pepyaka(Wix) andhcdn(Hostinger) are industry knowledge, not census data. - Excluded from the analysis:
Servervalues that are placeholders rather than software (ip-…,parking, registrar holding-page strings), which predictably send no security headers and would flatter no one and inform nothing. - Aggregate only. We report at the software-family level. We never name, grade or publish data about an individual registrant’s domain.
- Data is stored and processed within the EU.
What this means for IT managers, procurement teams, and business owners
The 13.7× gap between Netlify and Apache in HSTS adoption is not about effort or intent — it is about where the default lives. If your organisation is evaluating hosting platforms or reviewing its current infrastructure, this data makes the security implications of that choice legible. A move from self-managed Apache to a managed platform does not just change your operational overhead; it changes what your users receive without any additional configuration work.
For organisations already on self-managed infrastructure, the message is simpler: adding HSTS to Apache or nginx is a one-line change that takes minutes. The 29.1 million Apache sites without HSTS are not there because Apache makes it hard; they are there because nobody made the decision. If your organisation’s Apache or nginx configuration does not include Strict-Transport-Security, the remediation is a config file edit and a reload — and the users on your site will be protected against SSL-stripping attacks on every subsequent visit.
The Squarespace finding — 83.6% HSTS but precisely one CSP response across 8.75 million sites — is the most important lesson in this census for platform-hosted organisations. When you choose a managed platform, you are inheriting its security defaults and its gaps. If your platform has not shipped CSP defaults, essentially no site on that platform has one, because customers do not control the edge. Knowing which headers your platform ships and which it does not ship is a prerequisite for understanding your actual security posture — not what you configured, but what the platform delivers.
Data to cite
- “Netlify sends the HSTS security header on 95.9% of its 1.24 million measured sites; Apache sends it on just 7.0% of its 31.3 million — a 13.7× gap produced by a single platform-level default versus millions of individual operator decisions.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “Wix’s edge server sends X-Content-Type-Options on 100.0% of its 7,865,007 measured responses — demonstrating how one platform engineering decision simultaneously protects 7.87 million sites without any action by site owners.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “Squarespace delivers HSTS to 83.6% of its 8.75 million measured sites but sends exactly one Content-Security-Policy response across all of them — showing how platform defaults protect and constrain simultaneously.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “Caddy, marketed as a secure-by-default web server for its automatic HTTPS, sends HSTS on only 14.6% of its 1.94 million sites — because secure-by-default is a per-feature property and Caddy defaults transport encryption but leaves HSTS opt-in.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “191,715,808 HTTP responses (50.9% of 376.9 million graded) announce their server software — and every family above 60% HSTS adoption is a managed platform, while every self-managed server sits below 26%.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “The two self-hosted servers with the largest web presence — Apache (31.3M responses) and nginx (35.8M) — together serve 67.1 million domains while delivering HSTS to at most a quarter of their fleets.” — defaults.exposed August 2026 Domain Security Census (432M domains)
FAQ
Which web server is the most secure by default? Measured by delivered security headers across the August 2026 census, no traditional server wins; the managed platforms do. Netlify-served sites carry HSTS 95.9% of the time and Vercel-served sites 94.2%, against 25.5% for nginx and 7.0% for Apache. Among self-hosted servers, nginx’s fleet does best on HSTS and none does well on CSP.
Does Apache have worse security than nginx? The software itself is not what we measured. Both ship with security headers off; the 7.0% versus 25.5% HSTS gap reflects how their fleets are configured and what sits in front of them, not a vulnerability in either. The finding is that both models leave the large majority of sites without HSTS, while platform-managed hosting delivers it almost universally.
Is Caddy still “secure by default”? For transport, yes: its automatic HTTPS is real and remains its distinctive default. For headers, the census found Caddy-fronted sites send HSTS just 14.6% of the time (282 thousand of 1.94 million sites), because Caddy leaves that header opt-in. Secure-by-default is a per-feature property, and this is a feature where Caddy’s fleet looks like everyone else’s.
Why is CSP adoption so low everywhere? Because it is the one header a vendor cannot safely default. A wrong CSP visibly breaks sites, so platforms that happily default HSTS (Netlify 95.9% HSTS but 3.1% CSP) decline to impose a policy. The best large-family CSP rate we measured was 47.6%, on Hostinger’s CDN layer; most families are under 10%.
Does a missing Server header mean a site is hiding something? Usually not; 49.1% of graded responses simply do not announce their software, which is a defensible hardening choice as well as an artifact of some proxies. Note the direction of the inference, though: our figures describe sites that do announce, and the silent majority could differ. Header suppression tells you nothing about whether HSTS or CSP is present; those we measure directly.
How should I use this data when choosing a hosting platform? Look at the HSTS, CSP, and XCTO columns for your shortlisted platforms. High HSTS rate means users are protected against SSL-stripping by default. A near-zero CSP rate means you will need to solve CSP at the application or CDN layer yourself — the platform will not help. If your security requirements include CSP, confirm whether the platform allows customer-set response headers at the edge, or whether the edge layer overrides them. The Squarespace single-CSP finding illustrates the risk of assuming a high-HSTS platform will similarly default other headers.
What should I do right now if my site runs on Apache or nginx?
Add three headers to your server configuration: Strict-Transport-Security: max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff, and a Content-Security-Policy appropriate to your site’s resource graph. Each is a single line in a config file. The first two can be added without site testing; CSP requires an audit of your external resource dependencies before enforcement. Test in staging, then deploy — and check the result with a free scan to confirm the headers are delivered as configured.
See what your own domain sends
Check your domain free at defaults.exposed — see exactly which security headers your server delivers, whether your HSTS, CSP, and X-Content-Type-Options are present and correctly configured, and how your posture compares to the August 2026 census baseline. Takes 30 seconds. No account needed. Read the flagship State of Domain Security 2026 report.
Related in this series: The Internet Security Grade Curve · The Fully Protected Few
Aggregate data only. Data stored and processed in the EU.
How to cite this report
Press / blog: defaults.exposed (2026). Secure by Default: the Server Software Security Showdown. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/secure-by-default-server-software-showdown
Academic: defaults.exposed. (2026, August 18). Secure by Default: the Server Software Security Showdown. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/secure-by-default-server-software-showdown
In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=191,715,808 Server-header responses)
About the defaults.exposed August 2026 Census
The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.
Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026