Skip to content
henke.ws
henke.ws
Get in touch
  1. Home
  2. Data
  3. Security headers
68,774 sitesGlobal

Security headers statistics worldwide: HSTS, CSP

HSTS, CSP, X-Frame-Options and other protective headers.

53%
HSTS
35,770 / 67,751
30%
Content-Security-Policy
20,484 / 68,774
46%
X-Content-Type-Options
31,678 / 68,774
44%
X-Frame-Options
30,052 / 68,774

By market

MetricGlobalUnited KingdomNetherlandsItalySpainJapanLatin America
HSTS 53%51%52%40%49%33%45%
HSTS preload 17%14%16%12%15%4.9%15%
Content-Security-Policy 30%31%28%21%27%13%29%
X-Frame-Options 44%53%52%38%43%39%41%
X-Content-Type-Options 46%57%59%41%47%39%45%
Referrer-Policy 26%32%42%23%25%11%25%
Permissions-Policy 12%13%16%10%12%3.2%14%
Cross-Origin-Opener-Policy 4.1%8.2%12%3.6%3%0.8%3.8%
Server version exposed 10%7.7%12%16%11%10%15%
X-Powered-By exposed 19%20%20%25%27%14%23%
All cookies Secure 46%48%54%41%45%40%44%

Security headers

  1. 1 Strict-Transport-Security 52% 35,770
  2. 2 X-Content-Type-Options 46% 31,678
  3. 3 X-Frame-Options 44% 30,052
  4. 4 Content-Security-Policy 30% 20,484
  5. 5 X-XSS-Protection 27% 18,744
  6. 6 Referrer-Policy 26% 17,825
  7. 7 Report-To 24% 16,558
  8. 8 NEL 23% 15,791
  9. 9 Permissions-Policy 12% 8,461
  10. 10 COOP 4.1% 2,805
  11. 11 CSP Report-Only 3.5% 2,434
  12. 12 CORP 1.9% 1,334
  13. 13 COEP 0.8% 522

Share of 68,774 sites in the sample.

X-Powered-By values

  1. 1 PHP 4.7% 3,209
  2. 2 Nextjs 4.6% 3,177
  3. 3 ASPNET 2.5% 1,709
  4. 4 WP Engine 1.4% 937
  5. 5 Express 1.2% 838
  6. 6 Nuxt 0.8% 519
  7. 7 PHP/, PleskLin 0.6% 385
  8. 8 WordPress VIP <https://wpvipcom> 0.4% 286
  9. 9 PleskLin 0.3% 212
  10. 10 — 0.2% 118

Share of 68,774 sites in the sample.

Our crawler: 68,774 sites · Global · updated 13 Nov 2026 · Methodology

Infrastructure headaches?

Tell us about your stack — we reply within one business day.

Get in touchServices