State of Security Headers 2026: We Graded the Top 5,000 Websites

The web's most-visited sites are largely undefended at the HTTP-header layer. We took the Tranco top-5,000 domains, fetched each homepage, and graded the six core HTTP security headers with our own securityheaders.com-parity engine. Of the 3,494 sites that returned a real web page, 59.1% scored an F. Only 15.9% reached a "good" grade of B or better. The companies that build the modern web are among the worst offenders on their own front doors: google.com, microsoft.com and amazon.com all grade F, while the best-defended sector is security vendors and the A+ honor roll is dominated by governments.

Methodology (read this first)

We believe the transparency is the credibility, so the method comes before the findings. This is the same non-invasive homepage fetch that securityheaders.com ran publicly for years, run in-process with our own grader.

• Sample frame: the fixed top 5,000 domains by rank (ranks 1–5000) from the Tranco top-1M list, file dated 2026-07-21 (downloaded from tranco-list.eu). No filtering of the input slice.
• Crawl date: 2026-07-22. A single point-in-time snapshot — reproducible, not longitudinal.
• Grading engine: our own securityheaders.com-parity grader (the exact function behind the public /security-headers checker). It grades six core headers — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — and applies the A+ cap rule (a CSP with 'unsafe-inline'/'unsafe-eval' in script-src caps the grade at A). COOP/COEP/CORP are reported but not graded.
• Scan method: one lightweight HTTPS GET of each homepage (SSRF-safe, following redirects, grading the final response) plus one HTTP probe for the HTTPS-redirect check. Called directly in-process — not through our rate-limited public endpoint.
• HTML filter: a domain enters the graded set only if the graded response's Content-Type is text/html (or application/xhtml). JSON/plain-text/XML/infra responders are excluded as "not a website."
• No database writes. Results were held in memory and dumped to a throwaway JSON file. Nothing touched the product database.

Sample yield & exclusions

Of 5,000 domains attempted, 3,494 returned a gradeable HTML page. The rest either did not serve a browsable web page or were not HTML at all — and we keep those out of the grade distribution:

Why 1,397 failed: 999 do not resolve to a browsable apex (CDN/DNS/edge infra), 232 refused/failed the connection, 157 had a TLS/cert error or no HTTPS homepage, 8 were blocked or looped on redirects, 1 had an invalid hostname. The 109 non-HTML exclusions were mostly text/plain (43), no content-type (31), application/xml (16) and application/json (12) API/infra endpoints.

Grade distribution

Every graded site lands somewhere on the A+ to F scale. The distribution is bottom-heavy: F alone is larger than every other grade combined.

• Only 15.9% of top websites reach a good grade (A+/A/B combined = 557 sites).
• 59.1% score F, and 84.1% land at C or worse.
• The F rate is higher at 5,000 than our top-500 pilot (54%) — the tail past the top 500 is worse, not better.

Per-header adoption

The grade is driven by which of the six core headers a site actually ships with an acceptable value. Only one header — HSTS — is on even a bare majority of sites.

• HSTS is the only header on a majority — and only barely, at 51.9%.
• Permissions-Policy trails badly at 14.5% — it is the newest core header and adoption shows it.
• Only 34.5% deploy any CSP at all — the single most powerful anti-XSS header is absent from two-thirds of top sites.

Half of all CSPs are self-sabotaging

Deploying CSP is not the same as deploying it well. Of the 1,206 sites that ship a CSP, 617 — 51.2% of all CSPs, and 17.7% of every graded site — include 'unsafe-inline' or 'unsafe-eval' in script-src, which defeats most of CSP's XSS protection. A further 111 sites (3.2%) were capped at A (and would otherwise be A+) purely for that reason.

HTTPS redirect

2,886 sites (82.6%) enforce an HTTP→HTTPS upgrade. But 608 (17.4%) — roughly 1 in 6 — still serve HTTP without upgrading in 2026.

Per-sector breakdown

We applied best-effort keyword tagging to the graded domains. Sector n's are directional (see caveats), but the pattern is clear and counterintuitive: the technology sector — the people who build the web — has the worst header hygiene, while security vendors have the best.

The large "other" bucket (n = 2,839, 58.4% F) is not shown above because it is a catch-all, not a sector. Sector tags are heuristic keyword rules over the domain — treat the small-n rows (security vendors, finance) as directional.

• Security vendors are the clear winners — lowest F-rate (35.7%) and by far the best good-grade rate (39.3%). The firms that sell security practice it.
• Big Tech is the worst-performing labelled sector at 69.2% F — higher than finance, media or government. The companies that build the web have the weakest header hygiene on their own homepages.
• Ecommerce almost never reaches the top tier (good grade just 4.1%) — it clusters at C/D rather than F, so it is mediocre rather than absent.

The findings, with names

These are objective, reproducible header grades of public homepages — the same thing securityheaders.com published openly for years. We name them factually, not to mock: a header grade is a snapshot of one configuration choice, not a judgement of a company's overall security.

Household-name homepages scoring F

Real, browsable HTML homepages (not infra endpoints) from the world's biggest brands, all at F:

For contrast, a few large sites that do better: apple.com (B), facebook.com (B), github.com (B), netflix.com (D), reddit.com (D).

The A+ / A honor roll

Governments and security vendors dominate the top of the scale:

The newsroom split is stark

Same industry, opposite ends of the scale. Every major US business/financial masthead we graded scores F, while several European and tabloid titles top the scale:

Fintech is a bright spot inside a weak finance sector

Finance overall is 59% F, but modern fintechs punch above the incumbents: coinbase.com (A), stripe.com (B), robinhood.com (B) lead, while paypal.com (C), klarna.com (D) and binance.com (F), venmo.com (F) lag. (Finance n = 39 — directional only.)

Data-quality caveats

Stated plainly, because honest limits are what make the headline numbers trustworthy:

1. Homepage-only, top-slice sample. We grade the landing response after redirects (standard securityheaders.com method) across the Tranco top 5,000. Sites that set stronger headers on inner/app/login routes look worse here than their real app does, and behaviour deeper in the long tail is unknown.
2. The HTML filter is content-type based. It removes JSON/plain-text/infra responders, but cannot catch an HTML error/placeholder page (a parked or "coming soon" page that is technically text/html). A small residue of non-real sites may remain in the graded set.
3. Sector tags are heuristic and under-count. 2,839 of 3,494 sites fall into "other", and finance n = 39. Per-sector numbers are directional; a published sector cut should use a curated, labelled domain list per sector.
4. Grade parity is by design, not third-party-audited. Our engine is built to match securityheaders.com's model and individual grades were sanity-checked, but not diffed against the (now discontinued) securityheaders.com across the full set.
5. Point-in-time. Headers change. This is a single 2026-07-22 snapshot of the 2026-07-21 Tranco frame — reproducible, but not a trend line.

Check your own site

Want to know where your homepage lands on the same A+ to F scale used in this report? Our header checker runs the exact grader behind these numbers, free and without signup:

Scriptable too: curl "https://myssl.info/headers/check?q=example.com" returns the same grade on the X-Grade response header. Migrating off the discontinued securityheaders.com API? See our securityheaders.com API alternative & migration guide, or read the full HTTP security headers guide to fix what the grade flags.