September 2026 results
Across 5,827 readable home pages, the average site sets 2.3 of the six. Strict-Transport-Security is the most common, on 59% of pages, and Permissions-Policy the least, on 12%.
| Header | Sites setting it | What it protects against |
|---|---|---|
| Strict-Transport-Security | 59% | Stops a browser from ever falling back to an insecure connection. |
| X-Frame-Options | 50% | Stops another site from loading your page inside a hidden frame. |
| X-Content-Type-Options | 47% | Stops a browser from guessing a file type and running it as a script. |
| Content-Security-Policy | 35% | Limits which scripts and styles a page is allowed to load. |
| Referrer-Policy | 27% | Controls how much of your URL is handed to the sites you link out to. |
| Permissions-Policy | 12% | Turns off browser features a page has no business using, like the camera. |
Download the full dataset as CSV.
How this was measured
Chckr requested the home page of the top 10,000 domains on the Tranco list (list N2PYW) once each on September 16, 2026, and read what came back. 5,827 of them returned a readable HTML home page; the rest were content delivery hosts, API endpoints, or servers that turn automated requests away.
Response time is the wait before the first byte of the reply arrives, measured from a single location, so it carries the distance between the test machine and the server. Platform is detected from markers in the page itself, which means a site behind a heavy proxy or a custom build can be counted as unnamed. Everything here describes home pages, not whole sites.
Check your own headers
Enter your URL on the Chckr home page and the instant check reports how many of the six you set. The Security Headers test grades them from A to F and names what is missing, and the HTTP Observatory scan adds cookies, redirects and cross origin rules on top.