Web Security Posture
Adoption rates for SSL, HTTPS redirects, HSTS, CSP and the other security headers.
One entry per header or control, with the percentage of sites that ship it.
Download the JSONView as a table
| Item | Sites with it (%) |
|---|---|
| Ssl Valid | 99% |
| Https Redirect | 82% |
| Hsts | 58% |
| X Content Type Options | 52% |
| X Frame Options | 51% |
| Csp | 46% |
| Referrer Policy | 28% |
| Permissions Policy | 19% |
What is in it
| Field | Value |
|---|---|
| adoptionRates · sslValid · percentage | 98.7 |
| adoptionRates · sslValid · description | Sites with valid SSL certificate |
| adoptionRates · httpsRedirect · percentage | 81.8 |
| adoptionRates · httpsRedirect · description | Sites that redirect HTTP to HTTPS |
| adoptionRates · hsts · percentage | 57.8 |
| adoptionRates · hsts · description | Sites with HSTS header |
| adoptionRates · csp · percentage | 46.0 |
| adoptionRates · csp · description | Sites with Content-Security-Policy |
| adoptionRates · xFrameOptions · percentage | 50.9 |
| adoptionRates · xFrameOptions · description | Sites with X-Frame-Options |
| adoptionRates · xContentTypeOptions · percentage | 51.6 |
| adoptionRates · xContentTypeOptions · description | Sites with X-Content-Type-Options |
| adoptionRates · referrerPolicy · percentage | 27.6 |
| adoptionRates · referrerPolicy · description | Sites with Referrer-Policy |
| adoptionRates · permissionsPolicy · percentage | 18.9 |
| adoptionRates · permissionsPolicy · description | Sites with Permissions-Policy |
Where the numbers come from
Every value is aggregated from audits SlapMyWeb ran against live public URLs — each one fetched, rendered in a headless browser and measured. No survey, no panel, no modelling. Individual URLs are never published; only the aggregate is, which is what makes the set safe to release openly. The sample is sites people chose to audit, so it is not a random sample of the web — treat it as a benchmark of the kind of site that gets audited, not of the web as a whole.
Using it
CC-BY-4.0: use it anywhere, including commercially and for model training, as long as you credit the source.
SlapMyWeb. “Web Security Posture.” SlapMyWeb Open Data, https://slapmyweb.com/data/security-posture. CC-BY-4.0.