Direct answer: Of 25 homepages, only 5 return HSTS and 11 return CSP. Merging X-Frame-Options with CSP frame-ancestors, 14 declare clickjacking protection; 6 use nosniff, 4 have Referrer-Policy and 1 has Permissions-Policy. Seven sites have none of the six (28%) and no site has all six. Four sites still open over HTTP, and six disclose version information in headers.
This study reads response headers only, does not fetch the body for analysis and does not test browser behaviour; the 0–6 coverage score is a summary, not a security rating.
Method: one request, headers only
The study reuses the homepage sample from study 4 and revisits it serially on 2026-11-03 between 11:41 and 11:42, with at least 0.8 seconds between requests, reading headers and at most 64 KB of body. Of 26 candidate URLs, 25 return 200; E21 returns 502 and is excluded.
| Item | Rule | Boundary |
|---|---|---|
| HSTS | Strict-Transport-Security present | max-age, subdomains and preload recorded separately |
| CSP | Content-Security-Policy present | Report-Only listed separately |
| Anti-framing | XFO DENY/SAMEORIGIN or CSP frame-ancestors | Invalid XFO values do not count |
| nosniff | X-Content-Type-Options contains nosniff | — |
| Referrer / Permissions | Header present | Policy strictness not judged |
| Version disclosure | Server contains digits, or X-Powered-By present | No vulnerability judgement |
Result: uneven coverage, HSTS rarest
| Header | Sites | Share of 25 |
|---|---|---|
| CSP | 11 | 44.0% |
| Anti-framing (XFO or frame-ancestors) | 14 | 56.0% |
| HSTS | 5 | 20.0% |
| nosniff | 6 | 24.0% |
| Referrer-Policy | 4 | 16.0% |
| Permissions-Policy | 1 | 4.0% |
| Coverage score (0–6) | Sites | Note |
|---|---|---|
| 0 | 7 | None of the six |
| 1 | 6 | — |
| 2 | 7 | — |
| 4 | 4 | — |
| 5 | 1 | — |
| 6 | 0 | None complete |
The median coverage is 1. The distribution is polarised: seven sites score 0 while five reach 4 or more.
HSTS: five sites, all one year
- Five sites return HSTS, all with max-age 31,536,000 seconds (one year).
- Three add includeSubDomains and none sets preload.
- Another four sites still open over HTTP (the final URL is not HTTPS) and cannot carry HSTS.
HSTS only applies to HTTPS responses; a site that stays on HTTP must finish the HTTPS migration first.
Anti-framing: XFO and frame-ancestors split the field
| Method | Sites | Note |
|---|---|---|
| X-Frame-Options only | 7 | All SAMEORIGIN |
| CSP frame-ancestors only | 7 | No XFO, but CSP declares frame-ancestors |
| Both | 0 | — |
| Neither | 11 | One uses the obsolete ALLOW-FROM |
XFO and CSP are complementary paths; together 14 sites declare anti-framing. Counting XFO alone would miss the seven that declare it only in CSP.
Version disclosure and protocol
- Version disclosure: six sites, three with a numeric Server version and four returning X-Powered-By (the groups overlap).
- Server header: the most common value is a generic label (six sites share it); others include nginx, Apache and Tengine, some without a version.
- Protocol: 21 end on HTTPS and 4 remain HTTP (E04, E13, E16, E27).
- Report-Only CSP: zero; no site is trialling CSP in report mode.
What this means for acceptance
- Confirm HTTPS before HSTS. Four sites still open over HTTP, where HSTS cannot apply.
- Merge the two anti-framing forms. XFO alone misclassifies the seven sites using frame-ancestors.
- Longer HSTS is not automatically better. All five use one year but none uses preload; preload needs a separate decision.
- Prioritise the seven zero-score sites. Start with nosniff and anti-framing, then move to CSP.
- Track version disclosure separately. Six sites expose versions; that is not a vulnerability, but it helps targeted scanning.
Limits
- Single request: fetched once on 2026-11-03 11:41–11:42; CDNs and WAFs may vary headers by region or time.
- Headers only: TLS configuration, certificate chain, HSTS preload status and real browser blocking are not tested.
- Policy quality not judged: a CSP can exist and still be weak; the same applies to Permissions-Policy.
- Score is a summary: 0–6 is not a compliance or security conclusion.
- 25-site pilot: no industry claim.
Data and reproduction
Anonymised data: equipment-security-headers-2026.csv (25 rows × 20 columns: HSTS and parameters, CSP, XFO, frame-ancestors, nosniff, Referrer, Permissions, Server, X-Powered-By, score and protocol). The repository keeps docs/research/2026-11-security-headers.csv.
Parser: scripts/security_headers_probe.py; unit tests: scripts/test_security_headers_probe.py (10 tests, no network). Run:
python -m unittest scripts.test_security_headers_probe
Related: the article head metadata pilot, the HTTP date header pilot, and the protocol and hostname pilot.
Sources and definitions
- Homepage sample: the 25 homepages from study 4 (same sample_id).
- Fetch: 2026-11-03 11:41–11:42 Asia/Shanghai, serial, ≥0.8 s between requests.
- Rules: literal header values, case-insensitive names; Report-Only CSP listed separately.
- Coverage score: one point per item, for summary only.