~/home / header ranking: italy

Header ranking: Italy.

How well do 28 Italian websites (banks, news, telecom, government) set their security headers? Heatmap graded A to F, sortable, with a live check. As of 5 November 2026.

All GermanyItalyBanks

28sites checked

54 %without an effective CSP

3with grade A

48median score

54% of the sites send no effective CSP, the biggest lever.

Grade distribution

A 3B 4C 3D 9F 9

Rank	Website	Score	HSTS	CSP	nosniff	Frame	Referrer	Permissions	COOP	No leak
1	Aaruba.it	100	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: set	No leak: set	Check live
2	Amediaworld.it	100	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: set	No leak: set	Check live
3	Atg24.sky.it	95	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: set	Permissions: set	COOP: missing or too weak	No leak: set	Check live
4	Bfastweb.it	85	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
5	Bvodafone.it	80	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: missing or too weak	Check live
6	Bmps.it	75	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
7	Btim.it	75	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
8	Cbper.it	70	HSTS: set	CSP: set	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: missing or too weak	Check live
9	Cagid.gov.it	65	HSTS: missing or too weak	CSP: set	nosniff: set	Frame: set	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
10	Cansa.it	65	HSTS: set	CSP: set	nosniff: missing or too weak	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
11	Dagenziaentrate.gov.it	50	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
12	Dbancobpm.it	50	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
13	Dinps.it	50	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
14	Dmediolanum.com	50	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
15	Dfineco.it	45	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: missing or too weak	Check live
16	Diliad.it	45	HSTS: missing or too weak	CSP: set	nosniff: missing or too weak	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
17	Drai.it	45	HSTS: set	CSP: missing or too weak	nosniff: set	Frame: missing or too weak	Referrer: set	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
18	Dintesasanpaolo.com	40	HSTS: set	CSP: missing or too weak	nosniff: missing or too weak	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
19	Dregister.it	40	HSTS: set	CSP: missing or too weak	nosniff: missing or too weak	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
20	Flastampa.it	30	HSTS: missing or too weak	CSP: set	nosniff: missing or too weak	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
21	Frepubblica.it	30	HSTS: missing or too weak	CSP: set	nosniff: missing or too weak	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
22	Ftrenitalia.com	30	HSTS: missing or too weak	CSP: missing or too weak	nosniff: set	Frame: set	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
23	Fcorriere.it	15	HSTS: missing or too weak	CSP: missing or too weak	nosniff: missing or too weak	Frame: missing or too weak	Referrer: missing or too weak	Permissions: set	COOP: missing or too weak	No leak: set	Check live
24	Fposte.it	15	HSTS: missing or too weak	CSP: missing or too weak	nosniff: set	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
25	Fsubito.it	5	HSTS: missing or too weak	CSP: missing or too weak	nosniff: missing or too weak	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
26	Funicredit.it	5	HSTS: missing or too weak	CSP: missing or too weak	nosniff: missing or too weak	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
27	Fwindtre.it	5	HSTS: missing or too weak	CSP: missing or too weak	nosniff: missing or too weak	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: set	Check live
28	Filsole24ore.com	0	HSTS: missing or too weak	CSP: missing or too weak	nosniff: missing or too weak	Frame: missing or too weak	Referrer: missing or too weak	Permissions: missing or too weak	COOP: missing or too weak	No leak: missing or too weak	Check live

And your website?

In ten seconds you know which grade your site would get.

A badge for your siteAfter the check, the header checker gives you a live badge with your grade, ready to embed in a README or website.

How we measured

One HTTPS request per domain to the start page (up to three redirects); only the response headers are read. Points: CSP 25, HSTS 20, frame protection 15, nosniff, Referrer-Policy and Permissions-Policy 10 each, COOP and “no leak” 5 each. Grade A from 90, B from 75, C from 55, D from 35, otherwise F.

Reading it fairly

This is a snapshot of the start page. Headers can differ by path, region or client, and a low grade does not mean a service is insecure: large providers often protect things elsewhere, for example on separate sign-in domains. The list only scores these eight headers.

Starter set for nginx and the two most common mistakes →

← Home