I graded 35 big sites' security headers. Even the strong ones forget one.

Xavier — Thu, 08 Oct 2026 14:37:34 +0000

Your browser ships free, built-in armor that most sites never switch on: security headers. Each is one config line, they cost nothing, and together they kill whole classes of attacks. So I graded 35 well-known domains to see who actually turns them on.

The six that matter

Header	What it stops
`Strict-Transport-Security`	HTTPS downgrade / SSL stripping
`Content-Security-Policy`	injected scripts (XSS)
`X-Content-Type-Options`	MIME-sniffing trickery
`X-Frame-Options`	clickjacking
`Referrer-Policy`	leaking URLs (and tokens) in referrers
`Permissions-Policy`	camera / mic / geolocation abuse

Method

For each domain: curl -sI https://domain with a browser user agent, follow redirects, read the final response, count which of the six are present. Public data, reproducible in any terminal. Snapshot: 2026-10-08.

The spread

Median score: 5 / 6. Mean 3.7.

Distribution across 35 sites:

6/6  ██████ 6
5/6  ████████████ 12
4/6  ██ 2
3/6  █████ 5
2/6  ████ 4
1/6  ███ 3
0/6  ███ 3

Per header, how many of the 35 set it:

Header	Set (of 35)
Strict-Transport-Security	29
X-Frame-Options	26
X-Content-Type-Options	25
Content-Security-Policy	21
Referrer-Policy	18
Permissions-Policy	11

Full grades:

Domain	Score
aftonbladet.se	6/6
bbc.co.uk	6/6
cloudflare.com	6/6
duckduckgo.com	6/6
heroku.com	6/6
npmjs.com	6/6
apple.com	5/6
dropbox.com	5/6
github.com	5/6
kernel.org	5/6
linkedin.com	5/6
mastodon.social	5/6
mozilla.org	5/6
stackoverflow.com	5/6
stripe.com	5/6
vercel.com	5/6
x.com	5/6
youtube.com	5/6
medium.com	4/6
nytimes.com	4/6
google.com	3/6
netflix.com	3/6
reddit.com	3/6
spotify.com	3/6
wordpress.com	3/6
digitalocean.com	2/6
python.org	2/6
shopify.com	2/6
signal.org	2/6
gitlab.com	1/6
hashnode.com	1/6
wikipedia.org	1/6
amazon.com	0/6
microsoft.com	0/6
rust-lang.org	0/6

Three things that stood out

1. Permissions-Policy is the most-forgotten header. Only 11 of 35 set it. It's one line, and it's the only thing stopping a rogue embedded frame from asking for your camera or mic.

2. CSP is the one that actually stops XSS, and 14 of 35 skip it. HSTS and X-Frame-Options are table stakes. CSP is the hard one, and the one worth the effort.

3. Popularity is not safety. Two of the biggest consumer sites on the internet ship none of the six. Meanwhile a newspaper (aftonbladet.se) and a package registry (npmjs.com) ship all six clean. Rust's homepage is a perfect zero.

Why this keeps happening

Headers are invisible. Nothing breaks when they're missing, so nobody notices. And they're not a single switch: each is per-response, often set at the CDN edge, and easy to lose when you change hosts or add an origin.

Check your own site in 10 seconds

Run this:

curl -sI https://yourdomain.com

Then paste the whole header block into this page. It's a single static file, no build, no login, and nothing you paste leaves your browser (no network calls at all):

CyberSpace: Headers, free grader

It tells you what's set, what's missing, and what each gap actually costs.

Drop your domain in the comments and I'll reply with its six-header grade. If you'd rather have the gaps closed than found, say so.