I wanted to know how well well-known websites actually use security headers, so I pointed my free header checker at 57 of them: tech companies, social networks, shops, banks and payment providers, news sites, hosting and telecom providers, and government sites. The full result is a sortable heatmap in the header ranking. Here is what stands out.

The numbers

  • HSTS: 48 of 57 send it with a lifetime of at least six months. This one is mostly solved.
  • Frame protection (X-Frame-Options or frame-ancestors): 49 of 57.
  • X-Content-Type-Options: nosniff: 44 of 57.
  • Content-Security-Policy without 'unsafe-inline' in script-src: only 21 of 57. 63 % have no effective CSP.
  • Referrer-Policy: 14. Permissions-Policy: 15. Cross-Origin-Opener-Policy: 12.

The median score is 60 out of 100, a C. Four sites reach an A: gov.uk (95) and facebook.com, instagram.com and whatsapp.com (90 each).

Why CSP is the gap

The other headers are one-line switches. A Content-Security-Policy needs you to know every place your pages load scripts from, and a strict one breaks sites that depend on inline scripts and third-party tags. That is why it is the header most often missing, and also the one that does most against cross-site scripting. If you want a way in without breaking anything, start in report-only mode. The starter set for nginx shows how.

How to read this fairly

  • It is a snapshot of the start page. Headers can differ per path, region or client.
  • Only eight headers are scored. A low grade means these headers are not set here, not that a service is insecure.
  • Large providers often secure sign-in and API domains separately, and those are not in this list.
  • The scoring is the same as in the free checker: CSP 25, HSTS 20, frame protection 15, nosniff, Referrer-Policy and Permissions-Policy 10 each, COOP and “no version leak” 5 each.

What to do with it

Check your own site in ten seconds with the header checker, fix the cheap ones first (HSTS, nosniff, Referrer-Policy, Permissions-Policy), and plan the CSP as a small project with report-only mode first. Re-test after every change to your proxy, panel or CDN, because every layer can add or drop headers.

The ranking is rescanned from time to time. If you think a site is scored wrongly, tell me which one and why, and I will look at it.

Originally published at daniele-michelin.com. More guides, free checks (SPF, TLS, headers) and an error-message lexicon: daniele-michelin.com/en/.