Research / Top sites study

Security headers set: how the world's top websites do

Of 540 of the world's most popular websites that we audited, 271 pass this check and 269 fall short.

What this check means

Security headers instruct browsers to refuse certain attacks, such as loading the site inside another page. We look for the common ones: HSTS, content type options, frame protection and a content security policy.

Guide: HTTPS and security headers for website owners

How this was measured

The figure comes from Adnave's own audits of 551 popular websites, each read as a search engine first receives it and re-checked about once a month. A site “falls short” when the result is anything other than a pass. That is not always a mistake: a very large site may skip something on purpose. Sites that refuse automated visits are not in the sample, so the figure describes the popular sites that could be read, not the whole web. Full method and limits

Put this figure on your own page

The picture is drawn fresh from our data, so it stays up to date wherever you place it. Free to use; the code links back to this page as the source.

<a href="https://adnave.com/research/stats/security-headers"><img src="https://adnave.com/embed/security-headers.svg" alt="Share of the world's top websites that pass the check “Security headers set”. Live figure by Adnave." width="480" height="200" loading="lazy"></a>

Copy the code