State of Security Headers 2026: We Graded the Top 5,000 Websites

The web's most-visited sites are largely undefended at the HTTP-header layer. We took the Tranco top-5,000 domains, fetched each homepage, and graded the six core HTTP security headers with our own securityheaders.com-parity engine. Of the 3,494 sites that returned a real web page, 59.1% scored an F. Only 15.9% reached a "good" grade of B or better. The companies that build the modern web are among the worst offenders on their own front doors: google.com, microsoft.com and amazon.com all grade F, while the best-defended sector is security vendors and the A+ honor roll is dominated by governments.

Methodology (read this first)

We believe the transparency is the credibility, so the method comes before the findings. This is the same non-invasive homepage fetch that securityheaders.com ran publicly for years, run in-process with our own grader.

• Sample frame: the fixed top 5,000 domains by rank (ranks 1–5000) from the Tranco top-1M list, file dated 2026-07-21 (downloaded from tranco-list.eu). No filtering of the input slice.
• Crawl date: 2026-07-22. A single point-in-time snapshot — reproducible, not longitudinal.
• Grading engine: our own securityheaders.com-parity grader (the exact function behind the public /security-headers checker). It grades six core headers — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — and applies the A+ cap rule (a CSP with 'unsafe-inline'/'unsafe-eval' in script-src caps the grade at A). COOP/COEP/CORP are reported but not graded.
• Scan method: one lightweight HTTPS GET of each homepage (SSRF-safe, following redirects, grading the final response) plus one HTTP probe for the HTTPS-redirect check. Called directly in-process — not through our rate-limited public endpoint.
• HTML filter: a domain enters the graded set only if the graded response's Content-Type is text/html (or application/xhtml). JSON/plain-text/XML/infra responders are excluded as "not a website."
• No database writes. Results were held in memory and dumped to a throwaway JSON file. Nothing touched the product database.

Sample yield & exclusions

Of 5,000 domains attempted, 3,494 returned a gradeable HTML page. The rest either did not serve a browsable web page or were not HTML at all — and we keep those out of the grade distribution:

Why 1,397 failed: 999 do not resolve to a browsable apex (CDN/DNS/edge infra), 232 refused/failed the connection, 157 had a TLS/cert error or no HTTPS homepage, 8 were blocked or looped on redirects, 1 had an invalid hostname. The 109 non-HTML exclusions were mostly text/plain (43), no content-type (31), application/xml (16) and application/json (12) API/infra endpoints.

Grade distribution

Every graded site lands somewhere on the A+ to F scale. The distribution is bottom-heavy: F alone is larger than every other grade combined.

• Only 15.9% of top websites reach a good grade (A+/A/B combined = 557 sites).
• 59.1% score F, and 84.1% land at C or worse.
• The F rate is higher at 5,000 than our top-500 pilot (54%) — the tail past the top 500 is worse, not better.

Per-header adoption

The grade is driven by which of the six core headers a site actually ships with an acceptable value. Only one header — HSTS — is on even a bare majority of sites.

• HSTS is the only header on a majority — and only barely, at 51.9%.
• Permissions-Policy trails badly at 14.5% — it is the newest core header and adoption shows it.
• Only 34.5% deploy any CSP at all — the single most powerful anti-XSS header is absent from two-thirds of top sites.

Half of all CSPs are self-sabotaging

Deploying CSP is not the same as deploying it well. Of the 1,206 sites that ship a CSP, 617 — 51.2% of all CSPs, and 17.7% of every graded site — include 'unsafe-inline' or 'unsafe-eval' in script-src, which defeats most of CSP's XSS protection. A further 111 sites (3.2%) were capped at A (and would otherwise be A+) purely for that reason.

HTTPS redirect

2,886 sites (82.6%) enforce an HTTP→HTTPS upgrade. But 608 (17.4%) — roughly 1 in 6 — still serve HTTP without upgrading in 2026.

Per-sector breakdown

We applied best-effort keyword tagging to the graded domains. Sector n's are directional (see caveats), but the pattern is clear and counterintuitive: the technology sector — the people who build the web — has the worst header hygiene, while security vendors have the best.

The large "other" bucket (n = 2,839, 58.4% F) is not shown above because it is a catch-all, not a sector. Sector tags are heuristic keyword rules over the domain — treat the small-n rows (security vendors, finance) as directional.

• Security vendors are the clear winners — lowest F-rate (35.7%) and by far the best good-grade rate (39.3%). The firms that sell security practice it.
• Big Tech is the worst-performing labelled sector at 69.2% F — higher than finance, media or government. The companies that build the web have the weakest header hygiene on their own homepages.
• Ecommerce almost never reaches the top tier (good grade just 4.1%) — it clusters at C/D rather than F, so it is mediocre rather than absent.

The findings, with names

These are objective, reproducible header grades of public homepages — the same thing securityheaders.com published openly for years. We name them factually, not to mock: a header grade is a snapshot of one configuration choice, not a judgement of a company's overall security.

Household-name homepages scoring F

Real, browsable HTML homepages (not infra endpoints) from the world's biggest brands, all at F:

For contrast, a few large sites that do better: apple.com (B), facebook.com (B), github.com (B), netflix.com (D), reddit.com (D).

The A+ / A honor roll

Governments and security vendors dominate the top of the scale:

The newsroom split is stark

Same industry, opposite ends of the scale. Every major US business/financial masthead we graded scores F, while several European and tabloid titles top the scale:

Fintech is a bright spot inside a weak finance sector

Finance overall is 59% F, but modern fintechs punch above the incumbents: coinbase.com (A), stripe.com (B), robinhood.com (B) lead, while paypal.com (C), klarna.com (D) and binance.com (F), venmo.com (F) lag. (Finance n = 39 — directional only.)

Data-quality caveats

Stated plainly, because honest limits are what make the headline numbers trustworthy:

1. Homepage-only, top-slice sample. We grade the landing response after redirects (standard securityheaders.com method) across the Tranco top 5,000. Sites that set stronger headers on inner/app/login routes look worse here than their real app does, and behaviour deeper in the long tail is unknown.
2. The HTML filter is content-type based. It removes JSON/plain-text/infra responders, but cannot catch an HTML error/placeholder page (a parked or "coming soon" page that is technically text/html). A small residue of non-real sites may remain in the graded set.
3. Sector tags are heuristic and under-count. 2,839 of 3,494 sites fall into "other", and finance n = 39. Per-sector numbers are directional; a published sector cut should use a curated, labelled domain list per sector.
4. Grade parity is by design, not third-party-audited. Our engine is built to match securityheaders.com's model and individual grades were sanity-checked, but never diffed against securityheaders.com's own output across the full set. (Its API was discontinued in April 2026; the free web scanner is still running.)
5. Point-in-time. Headers change. This is a single 2026-07-22 snapshot of the 2026-07-21 Tranco frame — reproducible, but not a trend line. Re-checked 2026-08-11: 32 of the domains named on this page were re-graded and every one still held the grade shown here.

Check your own site

Want to know where your homepage lands on the same A+ to F scale used in this report? Our header checker runs the exact grader behind these numbers, free and without signup:

Scriptable too: curl "https://myssl.info/headers/check?q=example.com" returns the same grade on the X-Grade response header. Migrating off the discontinued securityheaders.com API? See our securityheaders.com API alternative & migration guide, or read the full HTTP security headers guide to fix what the grade flags.

Cite this report

The figures on this page are free to quote and cite with attribution to MySSL.info (CC BY 4.0). Journalists, researchers and AI assistants: use the stable permalink and formatted citation below. The full methodology is stated up front so any figure can be quoted in context.