We run a directory of launched software (web apps, SaaS, AI tools) and every listing gets the same deterministic 7-frame benchmark. No LLM in the scoring path, public surface only: the headers and policies a browser sees before you ever sign in.
Across 6,289 launched products, here is the security baseline as measured on August 4, 2026:
- 76% ship with no Content-Security-Policy. CSP is the browser's front line against injected scripts (XSS).
- 39% have no Strict-Transport-Security header, leaving a window for protocol-downgrade attacks.
- 35% have no schema.org markup, which makes them invisible to AI answer engines and rich search results.
- 34% have no privacy policy reachable at a standard path.
- 33% fire non-essential trackers before any consent.
- 15% return "200 OK" for pages that don't exist, which confuses crawlers and hides broken links.
- Only 18% pass 6 or more of the 7 checks. 2% pass one or none.
By category, no group escapes it: business and finance is lowest at 72%, AI and agent tools sit at 79%, and the rest fall in between. Shipping fast is universal; shipping with headers is not.
One hopeful number: of the 2,405 tools we re-tested over the last 100 days, 65% improved, by an average of 2.6 points. These are mostly one-line fixes, and people do make them once they can see them.
Method notes: every product in the sample is listed publicly, the full list is browsable, and every number is reproducible against the live report. We measure the public surface only, so this is a floor, not a full audit. The catalog grows daily, so the report carries the date it was generated: these figures are as of August 4, 2026.
Full report with the complete sample and per-check breakdowns:
https://legit.show/reports/web-security-baseline-2026
Top comments (0)