Index · Insights · Cert expiry · Fastest · Tools · API

We measured security headers on 446 popular sites.
The median scores 50 out of 100.

Measured 2026-11-14 · 446 sites · 26 verticals · open dataset, CC-BY-4.0

Summary. Across 446 of the most-visited sites on the web, the median security-header score is 50/100 and the mean is 51.4. 25% (111 sites) land in grade F — meaning they are missing at least half of the six headers we check. Only 8.1% (36 sites) score an A. The single most-missed control is Permissions-Policy: 79.6% of sites do not send it at all.

How this was measured

Every number on this page comes from a live HTTPS request made from a single measurement host, three probes per site, on 2026-11-14. We record six response headers, the TLS certificate chain and expiry, the negotiated TLS version, and HTTP availability. A site is graded on how many of the six headers it sends:

This is a presence test, not a policy-quality test. A site can send a technically-valid Content-Security-Policy: default-src * and score the same as one with a strict policy. Treat the grade as a floor, not a ceiling. Full method and raw values: data.json.

Grade distribution

The distribution is bimodal in a way that is easy to miss: 27% of sites get the headers basically right, and 25% get almost none of them right. The middle is thin. There is very little "partially configured" — sites tend to either have a header policy or not have one at all.

Which headers actually get deployed

HSTS is close to universal at 76.2%, and that is the one header a CDN can turn on for you in a checkbox. The two that require an actual decision about your own application — Content-Security-Policy and Permissions-Policy — sit at 51.8% and 20.4%. Header adoption tracks deployment friction, not security awareness.

Certificates

440 of 446 sites returned a parsable certificate. 17 expire within 30 days of the measurement date. Negotiated TLS: TLSv1.3 (404), TLSv1.2 (36).

Lowest and highest scoring

Ten lowest and ten highest of the 446 measured sites. Every site has its own page with the raw headers, certificate and DNS records.

Caveats, stated plainly

• Presence, not correctness. Sending a header is not the same as configuring it well.
• One vantage point. Measurements come from a single host. Response times in particular reflect that host's network path, not the site's global performance. Do not cite the latency figures as a performance benchmark.
• Response varies by edge and by path. A CDN can serve different headers to different regions, and / may differ from a deep page. We measure the root URL only.
• Stale entries are marked. 0 sites could not be reached on the most recent build and are showing their last successful measurement, flagged on their own page. Nothing on this site is estimated or interpolated.
• This is a snapshot. Headers change. The dataset is rebuilt daily and this page is regenerated from the same numbers as the dataset, so the two cannot drift apart.

Cite or reuse this

The dataset is released under CC-BY-4.0. Reuse it, chart it, contradict it.

Site Health Index (2026-11-14). "Security header grades across 446 popular websites."
https://pseo.rovy.tech/insights/ — dataset: https://pseo.rovy.tech/data.json (CC-BY-4.0)

Machine-readable: data.json · sitemap · API · openapi.json