A handful of HTTP response headers decide whether a browser forces HTTPS, refuses to run injected scripts or lets other sites frame yours. They cost nothing to send. On 8 October 2026 we requested the homepage of the 6,459 websites in the top 10,000 (the domains whose homepage is a web page; 6,312 answered over HTTPS) and recorded which of them each one sends, along with HTTP/3 and IPv6 support.
- 59% force HTTPS with HSTS (58.8%), and 20.7% have asked browsers to preload it.
- 35% send a Content-Security-Policy, but only 4.8% have one that blocks inline scripts. More than half of those policies don't restrict scripts at all, and most of the rest still allow inline scripts.
- 1 in 5 websites announces its software in a header (19.8%), and 9.4% include a version number. 102 of the 168 sites that name their PHP version name a release the PHP project no longer patches. Two weeks after the PHP2Shell fix, 75 of those still did.
- HTTP/3 on 35%, IPv6 on 47%. Cloudflare accounts for most of HTTP/3: 61.5% of sites served by it offer HTTP/3, against 22.5% of the rest.
- The top 1,000 do better on HSTS, CSP, HTTP/3 and IPv6, most of all on Content-Security-Policy: 51.3% send one, against 30.5% from rank 5,001 to 10,000.
| What we found | Websites | Share |
|---|---|---|
| Websites that answered over HTTPS (of the top 10,000) | 6,312 | 100% |
| HSTS (forces HTTPS) | 3,711 | 58.8% |
| Anti-framing (X-Frame-Options or frame-ancestors) | 3,654 | 57.9% |
| X-Content-Type-Options: nosniff | 3,017 | 47.8% |
| IPv6 address | 2,978 | 47.2% |
| HTTP/3 offered | 2,213 | 35.1% |
| Content-Security-Policy | 2,213 | 35.1% |
| ... that blocks inline scripts | 306 | 4.8% |
| Referrer-Policy | 1,747 | 27.7% |
| Permissions-Policy | 742 | 11.8% |
(HTTP/3 and Content-Security-Policy landing on the same count, 2,213, is a coincidence: only 768 sites have both.)
HSTS: most sites force HTTPS, fewer commit to it
HSTS tells the browser to use HTTPS for a site from now on, even if someone types http://. 58.8% of websites send
it. The details matter, though: 43.7% set it for at least a year, 32.2% cover their subdomains too, and 20.7% include
preload, the request to be built into browsers' HTTPS-only list.
Content-Security-Policy: a third send one, 1 in 20 has one that blocks inline scripts
A Content-Security-Policy tells the browser which scripts, styles and frames a page may load. Its main job is to stop injected scripts (cross-site scripting) from running. 35.1% of websites send one. But reading what the policies say gives a different picture:
| Content-Security-Policy | Websites | Share of all sites |
|---|---|---|
| Send the header | 2,213 | 35.1% |
| ... with no rule for scripts at all | 1,171 | 18.6% |
| ... restrict scripts, but allow inline scripts | 736 | 11.7% |
| ... restrict scripts and block inline scripts | 306 | 4.8% |
Most of the policies without a script rule are a single directive used for something else: frame-ancestors alone
(724 sites), which only controls who may frame the page, or upgrade-insecure-requests (187). Those are useful, but
they don't stop a script.
Among the policies that do restrict scripts, most still contain 'unsafe-inline', which lets inline scripts run, and
an injected script is usually inline. Browsers ignore 'unsafe-inline' when the same rule carries a nonce, a hash or
'strict-dynamic'; we counted those 103 policies as blocking inline scripts.
The top 1,000 are clearly ahead: 14.2% of them send a policy that blocks inline scripts, against 4.8% from rank 1,001 to 5,000 and 3.4% from 5,001 to 10,000.
1 in 5 websites announces its software
19.8% of websites say what they run in a header: X-Powered-By (Next.js 307 sites, PHP 168, WordPress 122, Express 81,
ASP.NET 75, Nuxt 43) or a Server header with a version number (nginx 203, Apache 93, Microsoft IIS 46). 9.4% include a
version number.
That number is a gift to anyone scanning for old software. 168 sites name their PHP version in X-Powered-By, and 102
of them (61%) name one the PHP project no longer supports with security fixes (PHP 7.4 is the most common, on 41 sites). The header isn't
proof of a hole: Linux distributions keep patching their own builds of older versions. But it tells everyone which
version to try.
PHP2Shell: what that header is worth
Two weeks after our check, this stopped being theory. On 21 October 2026 PHP shipped emergency fixes for PHP2Shell, two flaws that can let an attacker run code on a server without logging in, in nearly every version back to PHP 5.4. Government sites in Australia, the Netherlands and Finland, among others, went offline as a precaution while they patched, and by 26 October CISA had confirmed real attacks.
The header didn't cause any of this, and removing it fixes nothing: the flaws are there whether a site names its version or not, and only the patch closes them. But a version number does help the other side in two ways. Wiz says differences in PHP versions can break the assumptions an exploit depends on, so knowing the version helps an attacker aim. And once a fix is out, the header shows who hasn't installed it, in a single request. We found no report of attackers picking targets this way, and the attempts Cloudflare and Amazon reported were widespread anyway.
So we read the headers of those 168 sites again on 4 November, two weeks after the fix:
| What the header said on 4 November | Sites |
|---|---|
| A fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later) | 64 |
| PHP 8.1 or older, which gets no official release | 75 |
| No PHP version any more | 23 |
| A supported branch, still below the fix | 3 |
| A branch with no patch number (2), or no answer (1) | 3 |
Sites on a supported branch moved fast: 56 of the 64 that named one already show a fixed release. The old versions are the problem: 75 of the 102 still name PHP 8.1 or older. That alone doesn't prove a site is exposed, because PHP published source patches for 7.4, 8.0 and 8.1 and some vendors backport the fixes without changing the number. The 23 that dropped the version may have patched too; the header can no longer say. We aren't naming any of these sites, and the PHP version numbers are left out of the download.
Cookies: half are missing a basic flag
52.3% of homepages set a cookie on the first visit. 48.4% of those set at least one without the Secure flag (so it
could also travel over plain HTTP) and 58.7% at least one without SameSite.
HTTP/3 and IPv6
35.1% of websites offer HTTP/3, the newer protocol that runs over QUIC. Most of that is one company: Cloudflare serves 2,039 of the websites we checked, and 1,253 of them (61.5%) offer HTTP/3; among sites on other servers it's 960 of 4,273 (22.5%).
47.2% of websites have an IPv6 address (an AAAA record). Among the top 1,000 it's 51.1%.
The biggest sites do better on HSTS, CSP, HTTP/3 and IPv6
| Rank | Websites | HSTS | Content-Security-Policy | HTTP/3 | IPv6 |
|---|---|---|---|---|---|
| 1-1,000 | 550 | 67.5% | 51.3% | 39.5% | 51.1% |
| 1,001-5,000 | 2,416 | 62.3% | 37.6% | 34.0% | 48.1% |
| 5,001-10,000 | 3,346 | 54.9% | 30.5% | 35.1% | 45.9% |
Not on everything: the top 1,000 send a Referrer-Policy about as often as ranks 1,001 to 5,000 (29.1% against 29.6%),
and of the sites that set cookies, they leave out SameSite a little more often (59.0% against 56.5%).
Check your own site
- Paste your address into UpWatchr's HTTP Status Checker and open "Response headers":
look for
strict-transport-security,content-security-policy,x-content-type-optionsandx-frame-options. - If there's a
content-security-policy, findscript-src(ordefault-src). If it's missing, the policy doesn't restrict scripts. If it contains'unsafe-inline'without a nonce or hash, inline scripts still run. - If you see
x-powered-byor a version number afterServer:, both can usually be turned off in the server's configuration.
How we tested
| Sites | The 6,459 websites from the Tranco top 10,000 (list K9Z7W) whose homepage answered with an HTML page in the same week's crawl; 6,312 answered over HTTPS with a 2xx status |
| When | 8 October 2026, 11:48 to 12:11 UTC, from one connection in Poland |
| Method | One GET of the homepage, following redirects; the headers of the final HTTPS response. One DNS query per site for an AAAA record. HTTP/3 = an h3 entry in the alt-svc header |
| Not measured | HTTP/2 (our client couldn't negotiate it); policies set in a <meta> tag instead of a header; anything beyond the homepage |
| Re-check | On 4 November 2026 we requested the homepage of the 168 sites that named a PHP version in X-Powered-By, the same way. We read headers only and tested nothing. Four more sites name KPHP, VK's own compiler, which isn't PHP |
| Crawler | An honest user agent with a contact page; robots.txt honoured (sites that barred our crawler from the homepage aren't in the list) |
Download the data: sites.csv (the 6,312 websites that answered over HTTPS: each header, whether its CSP restricts scripts or blocks inline scripts, HTTP/3, IPv6, cookie flags; PHP version numbers removed so the file can't serve as a target list) · the CSV behind the chart : u5-adoption.csv.
FAQ
What is HSTS? HTTP Strict Transport Security, a header that tells browsers to connect to a site over HTTPS only,
for as long as its max-age says. 58.8% of the top 10,000 websites send it.
What is a Content-Security-Policy? A header listing where a page may load scripts, styles, images and frames from, so the browser refuses anything else, including injected scripts. 35.1% of top websites send one, but only 4.8% send one that blocks inline scripts.
Which security headers should a website have? At least Strict-Transport-Security, a Content-Security-Policy
with a script rule, X-Content-Type-Options: nosniff and anti-framing (frame-ancestors or X-Frame-Options). 21.3%
of the websites we checked send all four headers (counting any Content-Security-Policy, with or without a script rule),
and 23.4% send none of them.
Should I remove the X-Powered-By header? Yes. It tells visitors and scanners which software, and often which
version, runs your site, and browsers don't need it. 14.8% of top websites still send it. On PHP, set expose_php = Off
in php.ini. It won't protect an unpatched server, though: only the patch does.
How many websites support IPv6? 47.2% of the top 10,000 websites have an IPv6 address; 51.1% of the top 1,000.
How many websites support HTTP/3? 35.1% of the top 10,000 websites advertise it. 57% of those are served by Cloudflare.
