Security headers in 2026: what sites actually serve

Numbers here come from two places and are kept apart.

An independent survey, cited with its date and coverage. Per-header adoption shares are directly comparable — "the header is served or it is not" counts the same everywhere. Letter grades are computed differently by different tools and are not comparable.

Our own checks. Between 19 March and 27 August 2026 our header scanner ran 1,498 checks across 963 hosts. This is not a sample of the Russian web: these are domains somebody chose to check. Comparing zones inside the sample is sound; carrying the levels over to "all websites" is not.

Separately, on 27 August 2026, we requested headers directly from 113 hosts drawn from that history (59 in .ru, 54 in .com).

Scott Helme’s recurring Top 1 Million Analysis of 13 June 2026 covers 819,002 responding sites from the Tranco Top 1 Million. Adoption by header:

The same report gives the grade distribution: F — 53.9%, D — 20.3%, C — 5.0%, B — 8.8%, A — 7.5%, A+ — 1.3%. More than half the web still scores an F. The trend is upward, though: since June 2022 CSP more than doubled (79,549 → 170,057 sites) and Referrer-Policy tripled.

Coverage across the 113 hosts we queried directly, next to the top million:

Our sample runs above the top million on all six headers, by 10–25 percentage points. That does not mean the sites we check are better defended than the average site on the web: it follows directly from who brings a domain to a security scanner in the first place. The sampling caveat we attach to every page gets a number here.

The useful part of the comparison: the ranking barely changes. In both populations Permissions-Policy and Content-Security-Policy are the least served. The difference between "the ordinary web" and "operators who pay attention" is in the level, not the priorities.

Latest verdict per host across 961, mean score 50.8 out of 100:

8.1% earn an A or A+; 65% land on D or F. Our scale and the survey’s are computed differently, so the letters cannot be compared — only the per-header shares in the previous section can.

The spread between zones is about four points — smaller than the spread between everyone and a decent configuration: even the best zone averages 55 out of 100. The one header where .ru clearly trails is HSTS (54% against 69%), and it drags the TLS score down too: in a separate measurement HSTS was missing from 83% of Russian hosts graded B.

1. Start with HSTS — the clearest gap between zones and the cheapest to close: one header. Steps and pitfalls in HSTS and HSTS Preload.
2. Add X-Content-Type-Options: nosniff and Referrer-Policy — one line each, and they almost never break anything.
3. Permissions-Policy is the most neglected header on the web (12.4% in the top million). Switch off what the page does not use: camera, microphone, geolocation.
4. Leave CSP for last, and start in Report-Only. How to read and fix violations: CSP blocked a script; inspect an existing policy with the CSP analyzer.
5. Check your own domain — the header scanner scores the same components.