I checked what 16 web hosts serve on their own homepage: HSTS, HTTP/3, IPv6, TLS 1.3

I write hosting comparisons, and most of them repeat what the hosts say about themselves: free SSL, HTTP/3, "modern stack". So I checked what the hosts actually serve on their own homepage. One curl -sL per site, from one VPS in Germany, on 31 October 2026 at 18:22 UTC.

What I measured

For the final response after redirects:

• Strict-Transport-Security header present (HSTS)
• Content-Security-Policy header present (not its quality, only its presence)
• Alt-Svc advertising h3 (HTTP/3)
• an AAAA record on the final hostname (IPv6)
• a TLS 1.3 handshake accepted (openssl s_client -tls1_3)

curl -sL -o /dev/null -D hdr.txt -A "Mozilla/5.0 ..." \
  -w "%{http_code} %{url_effective} %{time_starttransfer}" https://$host/
dig +short AAAA $final_host
echo | openssl s_client -connect $final_host:443 -servername $final_host -tls1_3

Results: 16 hosts, 11 measurable

Five answered 403 to my request (LWS, Contabo, HostPapa, Bluehost, Scaleway). A 403 page from a bot filter tells you nothing about the real headers, so I count them as not measured, not as "no".

Host (final hostname)	HSTS	CSP	HTTP/3	IPv6	TLS 1.3
hetzner.com	yes	yes	yes	yes	yes
dreamhost.com	yes	yes	yes	yes	yes
ultahost.com	yes	yes	yes	yes	yes
infomaniak.com	yes	yes	no	yes	yes
hosting.com (from a2hosting.com)	yes	yes	no	yes	yes
siteground.com	yes	no	yes	no	yes
planethoster.com	yes	yes	no	no	yes
hostinger.com (from hostinger.fr)	no	no	yes	yes	yes
ionos.fr	yes	yes	no	no	no
ovhcloud.com	no	no	no	no	yes
o2switch.fr	no	no	no	no	yes

Counts on the 11: HSTS 8, CSP 7, HTTP/3 5, IPv6 6, TLS 1.3 10.

Three things I did not expect

1. ionos.fr refuses TLS 1.3. The handshake ends with tlsv1 alert protocol version; without the flag it negotiates TLS 1.2 (ECDHE-RSA-AES256-GCM-SHA384). That is still a secure protocol, but it is the only one of the 11 stuck there.
2. Two large French hosts send no HSTS on their homepage: o2switch and OVHcloud. o2switch also has no IPv6 record, no HTTP/3 and no CSP: it scored zero on four of five checks while being one of the most recommended shared hosts in France.
3. "HTTP/3" in a feature list and HTTP/3 on the vendor's own site are different things. Six of the 11 do not advertise it on their homepage.

What this does NOT tell you

This is the marketing site, not the servers you rent. A host can run a dated homepage and give customers HTTP/3, IPv6 and TLS 1.3 by default, or the reverse. The homepage is often behind a CDN the customer plan never touches. So do not pick a host from this table. Use it as a question to ask: if the plan page says "HTTP/3 included", test a customer site on that plan, the same way, before you trust the claim.

I compare two of these hosts (o2switch and PlanetHoster, which differ on two of the five checks here, HSTS and CSP) on the things that do matter for customers, price over 24 months, renewal and limits, in this o2switch vs PlanetHoster comparison.

Reproduce it

One request per host, and stop on a 403: hammering a bot filter will not make it answer. Results move: a host can enable HSTS tomorrow. This table is dated 31 October 2026, 18:22 UTC, and it is a snapshot, not a ranking.