Direct answer: The 25 homepages were rechecked about 38 hours later (2026-11-03 11:41/12:40 → 2026-11-05 01:4x). 24 sites kept identical security headers and 24 kept identical cache headers. Security: only E28 added X-Frame-Options: DENY, moving anti-framing from 14 to 15 sites. Cache: only E24 added Vary: Accept-Encoding, moving Vary from 22 to 23 sites. Everything else matches.
HSTS 5, CSP 11, nosniff 6, Referrer-Policy 4, Permissions-Policy 1 and version disclosure 6 are unchanged; Cache-Control distribution, ETag 4, Last-Modified 4, gzip 23, Brotli 1 and no compression 1 are unchanged too.
Method: same sites, two rechecks
A 24-hour recheck was planned; the global write lock was held by another track for a long time, so it happened about 38 hours later. On 2026-11-05 between 01:40 and 01:41 the 25 homepages were requested serially (≥0.8 s apart), first without Accept-Encoding for security headers, then with gzip, deflate, br for cache and compression. All 25 returned 200 in both passes; non-200 responses were retried three times.
| Item | Baseline | Recheck | Interval |
|---|---|---|---|
| Security headers | 2026-11-03 11:41–11:42 | 2026-11-05 01:40–01:41 | About 38 h |
| Cache/compression | 2026-11-03 12:40–12:41 | 2026-11-05 01:40–01:41 | About 37 h |
| Usable sites | 25 | 25 | — |
Security: only E28 adds XFO
| Item | Baseline | Recheck | Change |
|---|---|---|---|
| HSTS | 5 | 5 | 0 |
| CSP | 11 | 11 | 0 |
| Anti-framing (XFO or frame-ancestors) | 14 | 15 | +1 |
| nosniff | 6 | 6 | 0 |
| Referrer-Policy | 4 | 4 | 0 |
| Permissions-Policy | 1 | 1 | 0 |
| Version disclosure | 6 | 6 | 0 |
| Still HTTP | 4 | 4 | 0 |
| Coverage score | Baseline sites | Recheck sites |
|---|---|---|
| 0 | 7 | 6 |
| 1 | 6 | 7 |
| 2 | 7 | 7 |
| 4 | 4 | 4 |
| 5 | 1 | 1 |
| 6 | 0 | 0 |
E28 added X-Frame-Options: DENY between the two snapshots; the other 24 sites kept HSTS/CSP/framing/nosniff/Referrer/Permissions unchanged. The number of sites with none of the six falls from 7 to 6 solely because of this.
Cache: only E24 adds Vary
| Item | Baseline | Recheck | Change |
|---|---|---|---|
| No Cache-Control | 8 | 8 | 0 |
| no-store | 8 | 8 | 0 |
| private / no-cache | 8 | 8 | 0 |
| Positive max-age | 1 | 1 | 0 |
| ETag | 4 | 4 | 0 |
| Last-Modified | 4 | 4 | 0 |
| Vary: Accept-Encoding | 22 | 23 | +1 |
| gzip / br / none | 23 / 1 / 1 | 23 / 1 / 1 | 0 |
| chunked / Content-Length | 16 / 9 | 16 / 9 | 0 |
E24 keeps the same Cache-Control (no-cache, private) and gzip encoding; it only adds Vary: Accept-Encoding. The other 24 sites match field by field.
Change list
| Site | Change | Effect |
|---|---|---|
| E28 | Added X-Frame-Options: DENY | Anti-framing 14→15; its score 0→1 |
| E24 | Added Vary: Accept-Encoding | Vary 22→23; cache policy and encoding unchanged |
| Other 23 | No security or cache header change | — |
What this means for acceptance
- Header policy is stable over 38 hours. One change per set means most sites need no repeat remediation.
- Field-level diffs locate single edits. Totals differ by one, and the diff names E28's XFO and E24's Vary.
- One header can move the score. E28's XFO alone shifts its score from 0 to 1 and cuts the zero-score sites from 7 to 6.
- Vary is part of compression. E24 now lets caches separate compressed variants; compression itself is unchanged.
- Label the interval honestly. This is about 38/37 hours, not 24.
Limits
- About 38 hours: delayed by the lock, so it does not represent 24-hour change speed.
- Single recheck: two points only; no cause is inferred.
- CDN/WAF variance: headers may differ by region, time or UA.
- Headers only: TLS, cache hits, compressed size and browser behaviour are not tested.
- 25-site pilot: no industry claim.
Data and reproduction
Anonymised data: equipment-security-headers-recheck-2026.csv (25 rows: security baseline/recheck/change) and equipment-cache-compression-recheck-2026.csv (25 rows: cache baseline/recheck/change). The repository keeps both under docs/research/2026-11-*-recheck.csv.
Evaluation: scripts/security_headers_probe.py (10 tests) and scripts/cache_compression_probe.py (10 tests); comparison: scripts/header_recheck.py (6 tests). Run:
python -m unittest scripts.test_security_headers_probe scripts.test_cache_compression_probe scripts.test_header_recheck
Related: the homepage security header pilot, the homepage cache and compression pilot, and the article link structure delayed recheck., and the 48-hour header recheck
Sources and definitions
- Sites: the 25 usable homepages from study 48; hosts taken from their final URLs.
- Fetch: 2026-11-05 01:40–01:41, serial, ≥0.8 s apart; security pass without Accept-Encoding, cache pass with gzip/deflate/br.
- Failure handling: non-200 retried three times; both passes returned 25/25 200.
- Comparison: boolean and enum outputs from the modules; bytes and timestamps do not count as changes.