Skip to content
henke.ws
henke.ws
Get in touch
  1. Home
  2. Data
  3. Security headers
68,769 sitesGlobal

Security headers statistics worldwide: HSTS, CSP

HSTS, CSP, X-Frame-Options and other protective headers.

53%
HSTS
35,610 / 67,673
29%
Content-Security-Policy
20,286 / 68,769
45%
X-Content-Type-Options
31,131 / 68,769
44%
X-Frame-Options
29,961 / 68,769

By market

MetricGlobalUnited KingdomNetherlandsItalySpainJapanLatin America
HSTS 53%54%54%40%50%33%44%
HSTS preload 17%14%16%11%15%5%15%
Content-Security-Policy 29%33%29%22%28%13%29%
X-Frame-Options 44%52%49%39%44%38%40%
X-Content-Type-Options 45%56%54%41%46%38%43%
Referrer-Policy 25%29%36%21%24%11%24%
Permissions-Policy 12%13%16%10%11%3%13%
Cross-Origin-Opener-Policy 4%4.9%6.2%3.4%2.8%0.8%3.7%
Server version exposed 11%8.1%13%15%11%11%15%
X-Powered-By exposed 19%21%23%25%28%14%25%
All cookies Secure 45%45%51%37%43%38%43%

Security headers

  1. 1 Strict-Transport-Security 52% 35,610
  2. 2 X-Content-Type-Options 45% 31,131
  3. 3 X-Frame-Options 44% 29,961
  4. 4 Content-Security-Policy 29% 20,286
  5. 5 X-XSS-Protection 27% 18,851
  6. 6 Referrer-Policy 25% 17,424
  7. 7 Report-To 24% 16,175
  8. 8 NEL 22% 15,390
  9. 9 Permissions-Policy 12% 8,191
  10. 10 COOP 4% 2,781
  11. 11 CSP Report-Only 3.4% 2,304
  12. 12 CORP 1.9% 1,305
  13. 13 COEP 0.7% 505

Share of 68,769 sites in the sample.

X-Powered-By values

  1. 1 PHP 4.8% 3,283
  2. 2 Nextjs 4.6% 3,170
  3. 3 ASPNET 2.4% 1,679
  4. 4 WP Engine 1.3% 907
  5. 5 Express 1.2% 843
  6. 6 Nuxt 0.7% 512
  7. 7 PHP/, PleskLin 0.6% 423
  8. 8 WordPress VIP <https://wpvipcom> 0.4% 290
  9. 9 PleskLin 0.3% 194
  10. 10 — 0.2% 112

Share of 68,769 sites in the sample.

Our crawler: 68,769 sites · Global · updated 23 Oct 2026 · Methodology

Infrastructure headaches?

Tell us about your stack — we reply within one business day.

Get in touchServices