DE EN IT

~/blog / security-headers-57-websites

We graded the security headers of 57 big websites: only 21 ship an effective CSP

· Daniele Michelin · ~2 min read · Also in DE · IT

Banks, shops, news, hosting and government: one request per site, eight security headers, one grade from A to F. What the real world looks like, and what it does not tell you.

#security #http #headers #csp #research

Topics: Linux troubleshooting Security & patches

daniele@mikweb: ~/blog — less security-headers-57-websites.md

I wanted to know how well well-known websites actually use security headers, so I pointed my free header checker at 57 of them: tech companies, social networks, shops, banks and payment providers, news sites, hosting and telecom providers, and government sites. The full result is a sortable heatmap in the header ranking. Here is what stands out.

The numbers

  • HSTS: 48 of 57 send it with a lifetime of at least six months. This one is mostly solved.
  • Frame protection (X-Frame-Options or frame-ancestors): 49 of 57.
  • X-Content-Type-Options: nosniff: 44 of 57.
  • Content-Security-Policy without 'unsafe-inline' in script-src: only 21 of 57. 63 % have no effective CSP.
  • Referrer-Policy: 14. Permissions-Policy: 15. Cross-Origin-Opener-Policy: 12.

The median score is 60 out of 100, a C. Four sites reach an A: gov.uk (95) and facebook.com, instagram.com and whatsapp.com (90 each).

Why CSP is the gap

The other headers are one-line switches. A Content-Security-Policy needs you to know every place your pages load scripts from, and a strict one breaks sites that depend on inline scripts and third-party tags. That is why it is the header most often missing, and also the one that does most against cross-site scripting. If you want a way in without breaking anything, start in report-only mode. The starter set for nginx shows how.

How to read this fairly

  • It is a snapshot of the start page. Headers can differ per path, region or client.
  • Only eight headers are scored. A low grade means these headers are not set here, not that a service is insecure.
  • Large providers often secure sign-in and API domains separately, and those are not in this list.
  • The scoring is the same as in the free checker: CSP 25, HSTS 20, frame protection 15, nosniff, Referrer-Policy and Permissions-Policy 10 each, COOP and “no version leak” 5 each.

What to do with it

Check your own site in ten seconds with the header checker, fix the cheap ones first (HSTS, nosniff, Referrer-Policy, Permissions-Policy), and plan the CSP as a small project with report-only mode first. Re-test after every change to your proxy, panel or CDN, because every layer can add or drop headers.

The ranking is rescanned from time to time. If you think a site is scored wrongly, tell me which one and why, and I will look at it.

New articles by e-mail

One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).

daniele@mikweb: ~/blog — ls

More articles

HTTP security headers in ten minutes: a safe starter set for nginx and how to test itHSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy: what each security header does, a copy-paste nginx starter set, and how to test it.Scam radar: today's phishing emails and fake texts in plain words, updated twice a dayMy new scam radar collects current scams, explains them in plain words and says what to do. How it works, and how to spot a scam before you click.One week after PHP2Shell: attacked in the wild, and now a Linux kernel flaw on topPHP2Shell is exploited and on CISA's list. Now a Linux kernel flaw (CVE-2026-46300) can turn it into root. The facts in charts, and what to check today.

← All articles