Your browser ships free, built-in armor that most sites never switch on: security headers. Each is one config line, they cost nothing, and together they kill whole classes of attacks. So I graded 35 well-known domains to see who actually turns them on.
The six that matter
| Header | What it stops |
|---|---|
Strict-Transport-Security |
HTTPS downgrade / SSL stripping |
Content-Security-Policy |
injected scripts (XSS) |
X-Content-Type-Options |
MIME-sniffing trickery |
X-Frame-Options |
clickjacking |
Referrer-Policy |
leaking URLs (and tokens) in referrers |
Permissions-Policy |
camera / mic / geolocation abuse |
Method
For each domain: curl -sI https://domain with a browser user agent, follow redirects, read the final response, count which of the six are present. Public data, reproducible in any terminal. Snapshot: 2026-10-08.
The spread
Median score: 5 / 6. Mean 3.7.
Distribution across 35 sites:
6/6 ██████ 6
5/6 ████████████ 12
4/6 ██ 2
3/6 █████ 5
2/6 ████ 4
1/6 ███ 3
0/6 ███ 3
Per header, how many of the 35 set it:
| Header | Set (of 35) |
|---|---|
| Strict-Transport-Security | 29 |
| X-Frame-Options | 26 |
| X-Content-Type-Options | 25 |
| Content-Security-Policy | 21 |
| Referrer-Policy | 18 |
| Permissions-Policy | 11 |
Full grades:
| Domain | Score |
|---|---|
| aftonbladet.se | 6/6 |
| bbc.co.uk | 6/6 |
| cloudflare.com | 6/6 |
| duckduckgo.com | 6/6 |
| heroku.com | 6/6 |
| npmjs.com | 6/6 |
| apple.com | 5/6 |
| dropbox.com | 5/6 |
| github.com | 5/6 |
| kernel.org | 5/6 |
| linkedin.com | 5/6 |
| mastodon.social | 5/6 |
| mozilla.org | 5/6 |
| stackoverflow.com | 5/6 |
| stripe.com | 5/6 |
| vercel.com | 5/6 |
| x.com | 5/6 |
| youtube.com | 5/6 |
| medium.com | 4/6 |
| nytimes.com | 4/6 |
| google.com | 3/6 |
| netflix.com | 3/6 |
| reddit.com | 3/6 |
| spotify.com | 3/6 |
| wordpress.com | 3/6 |
| digitalocean.com | 2/6 |
| python.org | 2/6 |
| shopify.com | 2/6 |
| signal.org | 2/6 |
| gitlab.com | 1/6 |
| hashnode.com | 1/6 |
| wikipedia.org | 1/6 |
| amazon.com | 0/6 |
| microsoft.com | 0/6 |
| rust-lang.org | 0/6 |
Three things that stood out
1. Permissions-Policy is the most-forgotten header. Only 11 of 35 set it. It's one line, and it's the only thing stopping a rogue embedded frame from asking for your camera or mic.
2. CSP is the one that actually stops XSS, and 14 of 35 skip it. HSTS and X-Frame-Options are table stakes. CSP is the hard one, and the one worth the effort.
3. Popularity is not safety. Two of the biggest consumer sites on the internet ship none of the six. Meanwhile a newspaper (aftonbladet.se) and a package registry (npmjs.com) ship all six clean. Rust's homepage is a perfect zero.
Why this keeps happening
Headers are invisible. Nothing breaks when they're missing, so nobody notices. And they're not a single switch: each is per-response, often set at the CDN edge, and easy to lose when you change hosts or add an origin.
Check your own site in 10 seconds
Run this:
curl -sI https://yourdomain.com
Then paste the whole header block into this page. It's a single static file, no build, no login, and nothing you paste leaves your browser (no network calls at all):
CyberSpace: Headers, free grader
It tells you what's set, what's missing, and what each gap actually costs.
Drop your domain in the comments and I'll reply with its six-header grade. If you'd rather have the gaps closed than found, say so.
Top comments (0)