Skip to content
An independent index of 1,651 brand websites — platforms, security, email and SEO Web indexAdvertiseContact
coolbrands
Find a brand
coolbrands
Get in touch
  1. Home
  2. Data
  3. Security headers
1,359 sitesUK brands

Security headers statistics on brand websites: HSTS, CSP

HSTS, CSP, X-Frame-Options and other protective headers.

78%
HSTS
1,061 / 1,354
51%
Content-Security-Policy
688 / 1,359
71%
X-Content-Type-Options
968 / 1,359
65%
X-Frame-Options
885 / 1,359

By market

MetricUK brandsUnited KingdomGlobal
HSTS 78%54%53%
HSTS preload 23%14%17%
Content-Security-Policy 51%33%29%
X-Frame-Options 65%52%44%
X-Content-Type-Options 71%56%45%
Referrer-Policy 34%29%25%
Permissions-Policy 18%13%12%
Cross-Origin-Opener-Policy 4.1%4.9%4%
Server version exposed 4.3%8.1%11%
X-Powered-By exposed 17%21%19%
All cookies Secure 43%45%45%

Security headers

  1. 1 Strict-Transport-Security 78% 1,061
  2. 2 X-Content-Type-Options 71% 968
  3. 3 X-Frame-Options 65% 885
  4. 4 Content-Security-Policy 51% 688
  5. 5 X-XSS-Protection 47% 638
  6. 6 Referrer-Policy 34% 459
  7. 7 Report-To 20% 266
  8. 8 Permissions-Policy 18% 241
  9. 9 NEL 17% 235
  10. 10 CSP Report-Only 4.3% 59
  11. 11 COOP 4.1% 56
  12. 12 CORP 2.1% 29
  13. 13 COEP 1% 14

Share of 1,359 sites in the sample.

X-Powered-By values

  1. 1 Nextjs 4.4% 60
  2. 2 PHP 2.5% 34
  3. 3 WP Engine 2.4% 32
  4. 4 ASPNET 1.6% 22
  5. 5 Express 1.3% 18
  6. 6 WordPress VIP <https://wpvipcom> 0.7% 9
  7. 7 PHP/, PleskLin 0.7% 9
  8. 8 Nuxt 0.5% 7
  9. 9 — 0.4% 5
  10. 10 NIMHOST 0.3% 4

Share of 1,359 sites in the sample.

Our crawler: 1,359 sites · UK brands · updated 23 Oct 2026 · Methodology

Want your brand’s website benchmarked?

We compare your site with your category on security, speed, email and SEO — and fix what lags behind.

Get in touchServices