Security Headers and TLS on 5,326 Websites

Summary

We measured the HTTP response headers and TLS configuration of 5,326 domains, the majority drawn from a list of high-traffic global sites. Every figure below comes from a real request to the live site, not from a crawl of published data.

The headline: only 15.5% of these sites send a Content-Security-Policy header. For a control that has been shipping in every major browser for more than a decade, and which is the single most effective mitigation against cross-site scripting, that number is strikingly low — and these are not obscure sites.

TLS tells the opposite story. 84.8% negotiate TLS 1.3, the remaining 15.2% TLS 1.2, and not one site in the sample negotiated TLS 1.0 or 1.1. Transport encryption has been quietly won. Application-layer hardening has not.

Security header adoption

Percentage of the 5,326 domains sending each header, measured from the response to a single GET request:

Two things stand out.

The cheapest headers are not the most adopted. X-Content-Type-Options: nosniff is a single static value with essentially no failure mode, and it still only reaches 28.4%. It is not that these headers are hard to deploy — most sites have simply never deployed any of them.

Adoption falls off a cliff after the "classic four". The four best-known headers cluster between 14% and 29%. The newer isolation headers — COOP and COEP, which gate access to high-resolution timers and SharedArrayBuffer — sit at 4.5% and 3.8%. Adoption tracks how long a header has been widely written about, far more than it tracks the protection the header actually offers.

Inverting the CSP figure: 4,499 of 5,326 sites have no Content-Security-Policy at all. That is the number to sit with.

Information disclosure

Not everything is bad news. Most sites now avoid volunteering their stack:

This is the pattern where the default changed. Modern frameworks and reverse proxies stopped advertising versions out of the box, so the win arrived without anyone editing a config file. Which is the useful lesson for CSP: adoption follows defaults, not advocacy.

TLS

No site in the sample negotiated a deprecated protocol version. The long-running campaign to kill off TLS 1.0/1.1 appears, on this evidence, to be finished.

Certificate authorities

Issuing organisation for the 5,324 certificates we could inspect, rolled up from the intermediate that signed each leaf:

The free and bundled CAs now issue 64.3% of certificates in this sample between them — Let's Encrypt, Google Trust Services and Amazon. Google Trust Services reaching parity with Let's Encrypt is the result worth noting: it is a young CA, and much of that share arrives bundled with cloud hosting rather than being chosen deliberately.

Cookie flags

Across the 2,795 cookies observed being set:

Nearly half of all cookies are readable by JavaScript, and three in five carry no SameSite attribute. Note that browsers now default absent SameSite to Lax, so the practical exposure is smaller than the raw number suggests — but it means the behaviour is set by browser default rather than by the site.

Methodology

Population. 5,326 unique domains. Roughly 3,844 come from a list of high-traffic global websites, scanned systematically in April 2026; the remaining ~1,551 were submitted by users of the public BeaverCheck scanner. This is not a random sample of the web, and it is deliberately skewed toward larger, more professionally operated sites. If anything, that biases the numbers upward — a random sample of the whole web would almost certainly show lower adoption than reported here.

Measurement. One GET request per domain from a server in Europe, following no redirects, with headers read directly from the response and TLS details from the handshake. Where a domain was scanned more than once, only the most recent scan is counted. Data collected March–August 2026; figures frozen as of 16 August 2026.

A header is counted as present when it appears in the response with a non-empty value. We did not evaluate policy quality — a Content-Security-Policy of default-src * counts as present here. The real-world figure for effective CSP is therefore lower than 15.5%.

Reproducing this. Every domain in the sample has a permanent public result page on this site showing the raw findings, and the underlying per-check data is available through the free public API.

What we deliberately did not publish

Three measurements were dropped rather than reported, and the reasoning matters as much as the findings:

HTTP/2 adoption. Our probe reported that 100% of sites failed to negotiate HTTP/2 — which is obviously false. Investigating turned up a bug in our own client: Go's HTTP transport silently disables HTTP/2 when a custom dialer is configured, and we configure one for SSRF protection. We were measuring our own client, not the sites. The check has been fixed; we will report real numbers once re-scans complete.

Consent banners and privacy-policy detection. These produced far more dramatic headlines — apparent consent-banner presence of only 6.8% — and we do not believe them. Consent interfaces are typically injected by JavaScript after page load, and our detection misses them. The number measures our detector, not the web.

Core Web Vitals field data. We hold CrUX field data for only 349 domains in this sample, too few to say anything about the population.

If a statistic is not in this report, the most likely reason is that we could not defend it under scrutiny.

Notes

Percentages are rounded to one decimal place. The certificate sample is 5,324 rather than 5,326 because two domains did not complete a TLS handshake. Cookie percentages are per observed cookie, not per site, so a single site setting many cookies contributes proportionally more.