Security headers in 2026: 3 out of 4 websites have no Content-Security-Policy
Security headers in 2026: 3 out of 4 websites have no Content-Security-Policy
Security headers are a few lines in the server response that tell the browser how strict to be with a page. They cost nothing to send, they protect visitors against clickjacking, mixed content and script injection, and they are part of the security score in every LANGR SEO audit. In our data they are also the module with the lowest score: a median of 40 out of 100.
The numbers come from the latest audit of 94,853 websites that answered our scanner between April and October 2026.
How many sites send each header
| Header | Sites that send it |
|---|---|
| X-Content-Type-Options | 47.6 % |
| X-Frame-Options | 44.8 % |
| Strict-Transport-Security (HSTS) | 41.9 % |
| Referrer-Policy | 25.6 % |
| Content-Security-Policy | 23.5 % |
| Permissions-Policy | 8.4 % |
Not one header reaches half of the sites. HSTS is missing on 58.1 %, which means the first visit can still be downgraded to plain HTTP. On top of that, 17.7 % of the sites do not redirect HTTP to HTTPS at all.
Your platform decides most of it
| Platform | Sites | No Content-Security-Policy |
|---|---|---|
| Shopify | 4,411 | 2.6 % |
| Squarespace | 348 | 85.3 % |
| WordPress | 25,703 | 83.3 % |
| PrestaShop | 1,205 | 90.4 % |
| OpenCart | 455 | 94.3 % |
| Wix | 119 | 97.5 % |
| No CMS detected | 60,583 | 77.3 % |
Shopify sends a CSP for every shop, so almost no Shopify site is missing one. On WordPress and most self-hosted shop systems the headers depend on the host or on a plugin, and most sites never get them. If you run WordPress, your hosting setup matters more than your theme here.
The five lines that close most of the gap
These headers are safe for almost any site and can be added in the web server, a CDN like Cloudflare or a security plugin:
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()A Content-Security-Policy needs more care, because a strict policy can block your own scripts. Start with Content-Security-Policy-Report-Only, look at what it would block, and switch to the real header when the reports are clean.
Do security headers affect rankings?
Not directly. Google has confirmed HTTPS as a ranking signal, but not the individual headers. They still matter for SEO in practice: a hacked site with injected spam links loses rankings fast, and browsers warn visitors away from pages that load insecure content.
Run a free SEO audit to see exactly which headers your site sends, with a ready fix for each missing one. The terms are explained in the SEO A to Z.
Method: latest complete audit per domain, 94,853 websites with a headers result, collected April to October 2026, mostly newly registered and small business domains in 15 country markets. Platforms with fewer than 100 sites are left out, and no individual domain is named.