Nearly Half of the Company Websites We Checked Had No Security Headers - CipherCue

Directory<br>EU Vendors<br>Docs<br>Pricing<br>Blog<br>Log in

Book a demo<br>Sign up free

analysis<br>Nearly Half of the Company Websites We Checked Had No Security Headers

4 August 2026 &middot; 9 min read<br>&middot; By Chris McCabe

We ran 56,251 HTTP header checks across the primary domains of 50,769 companies in CipherCue's tracked entity set, most recently between 2026-03-26 and 2026-08-03. In 47.4% of those observations, the response we captured contained none of the seven security headers in our original test: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Permissions-Policy, Referrer-Policy, and X-XSS-Protection. Because a small number of domains were checked more than once in this window, that is currently an observation-level rate rather than a deduplicated company-level rate. "No security headers" here means none of these seven specific headers appeared on the captured response, not that the response carried no HTTP headers of any kind.

47.4% of 56,251 header checks in our dataset found none of seven standard security headers present on the response captured, as of our most recent observation window

What this measures

This is a presence check on a single captured HTTP response, not a security audit. We recorded whether each header appeared on that response, not whether its value was well-configured, and not what the same site sends on other routes, subdomains, or response types. Response type matters here: a redirect, an API response, an error page, or a bot-block page can legitimately carry a different header set to the final HTML document a visitor actually reads, and our data does not consistently record which type of response was captured for every check. A missing header on one observed response is evidence about that response, not a claim that the header is absent everywhere on the site, and it does not, on its own, demonstrate a working vulnerability.

What the headers do

Six of these headers are current browser-security controls; the seventh, X-XSS-Protection, is deprecated and included in the original measurement for completeness rather than because we treat it as equivalent to the other six.

HeaderWhat it does when present

Strict-Transport-Security (HSTS) Once received, tells the browser to use HTTPS for subsequent connections to the domain for a set period. It protects visits after the first one; without preloading, the very first connection before HSTS has been received is not covered.<br>X-Frame-Options Restricts whether a page can be framed by another site. CSP's frame-ancestors directive is the more modern and flexible control, so a response without X-Frame-Options may still have effective protection against framing if CSP is present.<br>X-Content-Type-Options Tells the browser to trust the declared Content-Type rather than guess a file's type from its content, which prevents MIME-sniffing.<br>Content-Security-Policy (CSP) An additional, browser-enforced restriction on which sources a page may load scripts, styles, and other resources from. Its absence removes one layer that can limit the impact of an injected script; it doesn't mean every injected script automatically runs unchecked.<br>Referrer-Policy Sets a deliberate, explicit policy for how much of the referring URL is passed to the next site on click-through. Modern browsers apply a default referrer policy even without this header; setting it explicitly replaces that default with a policy the site has chosen.<br>Permissions-Policy Narrows which origins or embedded documents may request specific browser capabilities (camera, microphone, geolocation, and others). Using one of these capabilities still requires user permission and the browser's own default allowlists still apply; this header is an additional restriction on top of those.<br>X-XSS-Protection (deprecated) Controlled an old browser-side XSS filter that modern browsers have removed; current guidance in some cases recommends disabling it rather than setting it. We measured it for completeness, not as a current control.

The full distribution

The distribution is heavily concentrated at zero, followed by an uneven spread across the remaining scores.

26,673

0 of 7

47.4%

5,352

1 of 7

9.5%

4,578

2 of 7

8.1%

6,659

3 of 7

11.8%

3,595

4 of 7

6.4%

5,212

5 of 7

9.3%

2,957

6 of 7

5.3%

1,225

7 of 7

2.2%

Share of all 56,251 header checks, by number of the original seven headers present

Headers presentObservationsShare

0 of 726,67347.4%<br>1 of 75,3529.5%<br>2 of 74,5788.1%<br>3 of 76,65911.8%<br>4 of 73,5956.4%<br>5 of 75,2129.3%<br>6 of 72,9575.3%<br>7 of 71,2252.2%

This is the original seven-header measurement, including the deprecated X-XSS-Protection header. A six-header distribution, current controls only, would need the underlying scoring rebuilt; we haven't done that for this article, so we're presenting the seven-header figures as what the data currently...