Security Headers in Runet 2026
Security headers analysis based on Enterno.io Security Scanner data for Q1 2026: HSTS is enabled by 64% of sites (mostly via Cloudflare), CSP only 18%, X-Frame-Options 71%, Permissions-Policy 9%. Average security grade — B. Top causes for C/D: missing HSTS, weak CSP or unsafe-inline, leaking Server header.
Methodology
Headers checked via Enterno.io Security Scanner — sample of ~50,000 public HTTPS sites in Runet. Grade A-F weighted: HSTS (20%), CSP (25%), X-Frame-Options (15%), X-Content-Type-Options (10%), Referrer-Policy (10%), Permissions-Policy (5%), cookies (15%).
Header coverage
| Header | Coverage |
|---|---|
| HSTS (Strict-Transport-Security) | 64% |
| X-Frame-Options | 71% |
| X-Content-Type-Options | 56% |
| Content-Security-Policy | 18% |
| Referrer-Policy | 31% |
| Permissions-Policy | 9% |
| Cross-Origin-* | 14% |
CSP remains the most-underused header — only 18% deploy it, and ~40% of those rely on unsafe-inline.
Grade distribution
| Grade | % |
|---|---|
| A+ | 7% |
| A | 21% |
| B | 35% |
| C | 24% |
| D-F | 13% |
Top issues
- Missing HSTS (36% of sites) — no Strict-Transport-Security, vulnerable to downgrade attack.
- unsafe-inline in CSP (~40% of the 18% with CSP) — creates false sense of security.
- Leaking Server header (52% of sites) — nginx/1.x.y + Apache version enables targeted CVE exploits.
- Missing Permissions-Policy (91%) — camera/microphone/geolocation default-allowed.
- Cookies without Secure/HttpOnly/SameSite (43% of sites with login).
Quick fixes
- In nginx:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; - Configure CSP with nonce (not unsafe-inline). Example + validator — /en/csp.
- Hide Server header:
server_tokens off;in nginx. - Permissions-Policy:
camera=(), microphone=(), geolocation=(). - Recheck via Security Scanner — should hit grade A.
Why teams trust us
How it works
Enter site URL
Security headers analyzed
Get grade A–F
What Does the Security Analysis Check?
The tool checks HTTP security headers, SSL/TLS configuration, server info leaks, and protection against common attacks (XSS, clickjacking, MIME sniffing). A grade fromA to F shows overall security level.
Header Analysis
Checking Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.
SSL Check
TLS version, certificate expiry, chain of trust, HSTS support.
Leak Detection
Finding exposed server versions, debug modes, open configs, and directories.
Report with Recommendations
Detailed report explaining each issue with specific steps to fix it.
Who uses this
Security teams
HTTP header audit
DevOps
config verification
Developers
CSP & HSTS setup
Auditors
compliance checks
Common Mistakes
Strict-Transport-Security.Server: Apache/2.4.52 helps attackers find exploits. Hide the version.DENY or SAMEORIGIN.nosniff, browsers may misinterpret file types (MIME sniffing).Best Practices
Content-Security-Policy-Report-Only, monitor violations, then enforce.Server, X-Powered-By, X-AspNet-Version from responses.Get more with a free account
Security check history and HTTP security header monitoring.
Sign up freeLearn more
How-to
Frequently Asked Questions
Is the data current?
Data collected in Q1 2026. Updated quarterly.
Can I cite this?
Yes, with attribution to Enterno.io.