~/home / header ranking: banks
Header ranking: banks.
How well do 19 banks and payment providers set their security headers? Heatmap graded A to F, sortable, with a live check on every row. As of 5 November 2026.
19sites checked
84 %without an effective CSP
0with grade A
60median score
84% of the sites send no effective CSP, the biggest lever.
Grade distribution
B 2C 9D 5F 3
| Rank | Website | Score | HSTS | CSP | nosniff | Frame | Referrer | Permissions | COOP | No leak | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Bconsorsbank.de | 75 | HSTS: set | CSP: set | nosniff: set | Frame: set | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 2 | Bmps.it | 75 | HSTS: set | CSP: set | nosniff: set | Frame: set | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 3 | Cbper.it | 70 | HSTS: set | CSP: set | nosniff: set | Frame: set | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: missing or too weak | Check live |
| 4 | Cdeutsche-bank.de | 70 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: set | Permissions: set | COOP: missing or too weak | No leak: set | Check live |
| 5 | Cpostbank.de | 70 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: set | Permissions: set | COOP: missing or too weak | No leak: set | Check live |
| 6 | Csparkasse.de | 70 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: set | Permissions: set | COOP: missing or too weak | No leak: set | Check live |
| 7 | Ccomdirect.de | 60 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: set | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 8 | Ccommerzbank.de | 60 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: set | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 9 | Cn26.com | 60 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: missing or too weak | Permissions: set | COOP: missing or too weak | No leak: set | Check live |
| 10 | Cpaypal.com | 60 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: missing or too weak | Permissions: set | COOP: missing or too weak | No leak: set | Check live |
| 11 | Ctargobank.de | 60 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: set | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 12 | Dbancobpm.it | 50 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 13 | Ddkb.de | 50 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 14 | Dmediolanum.com | 50 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 15 | Dfineco.it | 45 | HSTS: set | CSP: missing or too weak | nosniff: set | Frame: set | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: missing or too weak | Check live |
| 16 | Dintesasanpaolo.com | 40 | HSTS: set | CSP: missing or too weak | nosniff: missing or too weak | Frame: set | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 17 | Fposte.it | 15 | HSTS: missing or too weak | CSP: missing or too weak | nosniff: set | Frame: missing or too weak | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 18 | Fhypovereinsbank.de | 5 | HSTS: missing or too weak | CSP: missing or too weak | nosniff: missing or too weak | Frame: missing or too weak | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
| 19 | Funicredit.it | 5 | HSTS: missing or too weak | CSP: missing or too weak | nosniff: missing or too weak | Frame: missing or too weak | Referrer: missing or too weak | Permissions: missing or too weak | COOP: missing or too weak | No leak: set | Check live |
No matches.
And your website?
In ten seconds you know which grade your site would get.
A badge for your siteAfter the check, the header checker gives you a live badge with your grade, ready to embed in a README or website.
How we measured
One HTTPS request per domain to the start page (up to three redirects); only the response headers are read. Points: CSP 25, HSTS 20, frame protection 15, nosniff, Referrer-Policy and Permissions-Policy 10 each, COOP and “no leak” 5 each. Grade A from 90, B from 75, C from 55, D from 35, otherwise F.
Reading it fairly
This is a snapshot of the start page. Headers can differ by path, region or client, and a low grade does not mean a service is insecure: large providers often protect things elsewhere, for example on separate sign-in domains. The list only scores these eight headers.