Skip to content
mistakes.show
793Kissues on 68,769 sites
mistakes.show
Get in touch
  1. Home
  2. Data
  3. Security headers
68,769 sitesGlobal

HSTS & CSP adoption worldwide

HSTS, CSP, X-Frame-Options and other protective headers.

53%
HSTS
35,610 / 67,673
29%
Content-Security-Policy
20,286 / 68,769
45%
X-Content-Type-Options
31,131 / 68,769
44%
X-Frame-Options
29,961 / 68,769

By market

MetricGlobalUnited KingdomNetherlandsItalySpainJapanLatin America
HSTS53%54%54%40%50%33%44%
HSTS preload17%14%16%11%15%5%15%
Content-Security-Policy29%33%29%22%28%13%29%
X-Frame-Options44%52%49%39%44%38%40%
X-Content-Type-Options45%56%54%41%46%38%43%
Referrer-Policy25%29%36%21%24%11%24%
Permissions-Policy12%13%16%10%11%3%13%
Cross-Origin-Opener-Policy4%4.9%6.2%3.4%2.8%0.8%3.7%
Server version exposed11%8.1%13%15%11%11%15%
X-Powered-By exposed19%21%23%25%28%14%25%
All cookies Secure45%45%51%37%43%38%43%

Security headers

  1. 1Strict-Transport-Security52%35,610
  2. 2X-Content-Type-Options45%31,131
  3. 3X-Frame-Options44%29,961
  4. 4Content-Security-Policy29%20,286
  5. 5X-XSS-Protection27%18,851
  6. 6Referrer-Policy25%17,424
  7. 7Report-To24%16,175
  8. 8NEL22%15,390
  9. 9Permissions-Policy12%8,191
  10. 10COOP4%2,781
  11. 11CSP Report-Only3.4%2,304
  12. 12CORP1.9%1,305
  13. 13COEP0.7%505

Share of 68,769 sites in the sample.

X-Powered-By values

  1. 1PHP4.8%3,283
  2. 2Nextjs4.6%3,170
  3. 3ASPNET2.4%1,679
  4. 4WP Engine1.3%907
  5. 5Express1.2%843
  6. 6Nuxt0.7%512
  7. 7PHP/, PleskLin0.6%423
  8. 8WordPress VIP <https://wpvipcom>0.4%290
  9. 9PleskLin0.3%194
  10. 10—0.2%112

Share of 68,769 sites in the sample.

Our crawler: 68,769 sites · Global · updated Oct 23, 2026 · Methodology

Found mistakes on your site?

We can fix them in one sprint. Reply within one business day.

Get in touchServices