~/home / header ranking: germany

Header ranking: Germany.

How well do 38 German websites (banks, shops, news, hosting, government) set their security headers? Heatmap graded A to F, sortable, with a live check. As of 5 November 2026.

AllGermanyItaly Banks

38sites checked

63 %without an effective CSP

0with grade A

60median score

63% of the sites send no effective CSP, the biggest lever.

Grade distribution

B 10C 20D 5F 3

Rank	Website	Score	HSTS	CSP	nosniff	Frame	Referrer	Permissions	COOP	No leak
1	B1und1.de	85	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
2	Bamazon.de	85	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: set	COOP: missing or too weak	No leak: set	Check live
3	Bbund.de	85	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
4	Bhetzner.com	85	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
5	Bt-online.de	85	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
6	Bconsorsbank.de	75	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
7	Bdeutschebahn.com	75	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
8	Botto.de	75	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
9	Brewe.de	75	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: set	No leak: set	Check live
10	Bwelt.de	75	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: set	No leak: set	Check live
11	Cdeutsche-bank.de	70	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: missing or too weak	No leak: set	Check live
12	Cgmx.net	70	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: missing or too weak	No leak: set	Check live
13	Cpostbank.de	70	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: missing or too weak	No leak: set	Check live
14	Csparkasse.de	70	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: missing or too weak	No leak: set	Check live
15	Cweb.de	70	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: missing or too weak	No leak: set	Check live
16	Cionos.de	65	HSTS: set	CSP: set	nosniff: missing or too weak	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
17	Cspiegel.de	65	HSTS: set	CSP: set	nosniff: missing or too weak	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
18	Csueddeutsche.de	65	HSTS: set	CSP: set	nosniff: missing or too weak	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
19	Cbild.de	60	HSTS: set	CSP: set	nosniff: set	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
20	Ccomdirect.de	60	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
21	Ccommerzbank.de	60	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
22	Cdhl.de	60	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
23	Cn26.com	60	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: set	COOP: missing or too weak	No leak: set	Check live
24	Ctagesschau.de	60	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: set	COOP: missing or too weak	No leak: set	Check live
25	Ctargobank.de	60	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
26	Cvodafone.de	60	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
27	Czalando.de	60	HSTS: set	CSP: set	nosniff: missing or too weak	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: missing or too weak	Check live
28	Cheise.de	55	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: set	No leak: set	Check live
29	Ckaufland.de	55	HSTS: missing or too weak	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: set	No leak: set	Check live
30	Czeit.de	55	HSTS: missing or too weak	CSP: set	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
31	Ddkb.de	50	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
32	Dlidl.de	50	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
33	Dmediamarkt.de	40	HSTS: set	CSP: missing or too weak	nosniff: missing or too weak	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
34	Dbundesregierung.de	35	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
35	Dstrato.de	35	HSTS: set	CSP: missing or too weak	nosniff: missing or too weak	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: missing or too weak	Check live
36	Febay.de	25	HSTS: set	CSP: missing or too weak	nosniff: missing or too weak	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
37	Ftelekom.de	25	HSTS: set	CSP: missing or too weak	nosniff: missing or too weak	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
38	Fhypovereinsbank.de	5	HSTS: missing or too weak	CSP: missing or too weak	nosniff: missing or too weak	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live

And your website?

In ten seconds you know which grade your site would get.

A badge for your siteAfter the check, the header checker gives you a live badge with your grade, ready to embed in a README or website.

How we measured

One HTTPS request per domain to the start page (up to three redirects); only the response headers are read. Points: CSP 25, HSTS 20, frame protection 15, nosniff, Referrer-Policy and Permissions-Policy 10 each, COOP and “no leak” 5 each. Grade A from 90, B from 75, C from 55, D from 35, otherwise F.

Reading it fairly

This is a snapshot of the start page. Headers can differ by path, region or client, and a low grade does not mean a service is insecure: large providers often protect things elsewhere, for example on separate sign-in domains. The list only scores these eight headers.

Starter set for nginx and the two most common mistakes →

← Home