Direct answer: The 25 homepages were checked again after about 48 hours (2026-11-05 12:41–12:43). Compared with the 01:40 snapshot, all six policy fields in both header sets show zero changes. Since 2026-11-03 the only cumulative changes remain two: E28 added X-Frame-Options: DENY and E24 added Vary: Accept-Encoding; both persist.
HSTS 5, CSP 11, anti-framing 15, nosniff 6, Referrer 4, Permissions 1 and version disclosure 6 are unchanged; cache policy distribution, ETag 4, Last-Modified 4, Vary 23, gzip 23, Brotli 1 and no compression 1 are unchanged too. The only non-policy difference is E20 moving from chunked to Content-Length (25 pages either way), a transport shift.
Method: a third snapshot
The study uses the 25 usable homepages from study 48 and their final hosts. On 2026-11-05 between 12:41 and 12:43 it requests each site twice, serially with at least 0.8 s between: security headers without Accept-Encoding, cache headers with gzip, deflate, br; only headers and at most 1 KB are read. All 25 sites returned 200 in both passes.
| Snapshot | Security | Cache | Interval |
|---|---|---|---|
| Baseline | 11-03 11:41 | 11-03 12:40 | — |
| Study 55 | 11-05 01:40 | 11-05 01:40 | About 38/37 h |
| This study | 11-05 12:41 | 11-05 12:41 | About 49/48 h |
Security: three snapshots
| Item | Baseline | 38 h | 48 h |
|---|---|---|---|
| HSTS | 5 | 5 | 5 |
| CSP | 11 | 11 | 11 |
| Anti-framing | 14 | 15 | 15 |
| nosniff | 6 | 6 | 6 |
| Referrer-Policy | 4 | 4 | 4 |
| Permissions-Policy | 1 | 1 | 1 |
| Version disclosure | 6 | 6 | 6 |
| Still HTTP | 4 | 4 | 4 |
| Score | Baseline | 38 h | 48 h |
|---|---|---|---|
| 0 | 7 | 6 | 6 |
| 1 | 6 | 7 | 7 |
| 2 | 7 | 7 | 7 |
| 4 | 4 | 4 | 4 |
| 5 | 1 | 1 | 1 |
| 6 | 0 | 0 | 0 |
Cache and compression: three snapshots
| Item | Baseline | 38 h | 48 h |
|---|---|---|---|
| No Cache-Control | 8 | 8 | 8 |
| no-store | 8 | 8 | 8 |
| private / no-cache | 8 | 8 | 8 |
| Positive max-age | 1 | 1 | 1 |
| ETag | 4 | 4 | 4 |
| Last-Modified | 4 | 4 | 4 |
| Vary: Accept-Encoding | 22 | 23 | 23 |
| gzip / br / none | 23 / 1 / 1 | 23 / 1 / 1 | 23 / 1 / 1 |
Change list: nothing new
| Site | Change | Status |
|---|---|---|
| E28 | Added X-Frame-Options: DENY | Appeared at 38 h, persists at 48 h |
| E24 | Added Vary: Accept-Encoding | Appeared at 38 h, persists at 48 h |
| E20 | chunked → Content-Length | Transport change, not a policy field |
| Other 22 | No policy change in either set | — |
E20's chunked/Content-Length shift does not change cache policy or encoding; the 25 pages still use one transport each (15 chunked, 10 Content-Length in this snapshot).
What this means for acceptance
- Policy is stable for 48 hours. No policy field changed between the 38-hour and 48-hour snapshots.
- The E28 and E24 fixes persist. The new XFO and Vary did not revert; they look like settled single-site fixes.
- Backlog does not disappear by itself. Six sites score 0, four are HTTP, eight lack Cache-Control, and only one has a positive max-age.
- Transport can fluctuate. E20 moved between chunked and Content-Length and should not count as a policy change.
- 48-hour stability is not permanence. One recheck cannot infer long-term behaviour or the industry.
Limits
- About 49/48 hours: not the same instant, so not a precise rate.
- Single snapshot: CDNs and WAFs may vary by region, time or UA.
- Headers only: cache hits, compressed size and browser behaviour are not tested.
- Policy field scope: eight security and six cache fields are compared; chunked/Content-Length are separate.
- 25-site pilot: no industry claim.
Data and reproduction
Anonymised data: equipment-security-headers-recheck48-2026.csv (25 rows, three snapshots) and equipment-cache-compression-recheck48-2026.csv (25 rows, three snapshots). The repository keeps both under docs/research/2026-11-*-recheck48.csv.
Evaluation and comparison: security_headers_probe.py (10 tests), cache_compression_probe.py (10), header_recheck.py (6). Run:
python -m unittest scripts.test_security_headers_probe scripts.test_cache_compression_probe scripts.test_header_recheck
Related: the 38-hour header recheck, the homepage security header pilot, and the homepage cache and compression pilot.
Sources and definitions
- Sites: the 25 usable homepages from study 48.
- Fetch: 2026-11-05 12:41–12:43, serial, ≥0.8 s apart; both passes returned 25/25 200.
- Comparison: eight security and six cache policy fields; chunked/Content-Length listed separately.
- Timing: about 49 hours for security, 48 for cache.