Skip to content
IEDE Data processing & engineering
Request a quote
Quick tools JSON formatterJSON ↔ CSV converterJSON ↔ YAML converterJSON to SQLJSON to TypeScriptXML formatterData size calculatorBase64 encoder/decoder
IEDE
Get in touch
  1. Home
  2. Data
  3. Security headers
11,322 sitesUnited Kingdom

Security headers statistics in the UK: HSTS, CSP

HSTS, CSP, X-Frame-Options and other protective headers.

50%
HSTS
5,598 / 11,186
29%
Content-Security-Policy
3,321 / 11,322
57%
X-Content-Type-Options
6,474 / 11,322
53%
X-Frame-Options
5,982 / 11,322

By market

MetricUnited KingdomGlobalNetherlandsItalySpainJapanLatin America
HSTS 50%53%52%40%49%33%45%
HSTS preload 14%17%16%12%15%5%16%
Content-Security-Policy 29%30%28%21%27%13%29%
X-Frame-Options 53%44%52%38%43%39%41%
X-Content-Type-Options 57%47%59%41%47%39%45%
Referrer-Policy 34%27%42%23%25%12%26%
Permissions-Policy 14%13%17%10%12%3.3%15%
Cross-Origin-Opener-Policy 8.7%4.2%12%3.6%3%0.9%3.9%
Server version exposed 7.9%10%12%16%11%10%15%
X-Powered-By exposed 20%19%20%25%27%14%23%
All cookies Secure 52%47%54%42%45%40%45%

Security headers

  1. 1 X-Content-Type-Options 57% 6,474
  2. 2 X-Frame-Options 53% 5,982
  3. 3 Strict-Transport-Security 49% 5,598
  4. 4 Report-To 38% 4,317
  5. 5 NEL 37% 4,164
  6. 6 Referrer-Policy 34% 3,854
  7. 7 X-XSS-Protection 30% 3,434
  8. 8 Content-Security-Policy 29% 3,321
  9. 9 Permissions-Policy 14% 1,555
  10. 10 COOP 8.7% 990
  11. 11 CSP Report-Only 4.2% 480
  12. 12 CORP 1.5% 170
  13. 13 COEP 0.8% 86

Share of 11,322 sites in the sample.

X-Powered-By values

  1. 1 PHP 6.1% 685
  2. 2 ASPNET 3.6% 407
  3. 3 Nextjs 2.4% 270
  4. 4 PHP/, PleskLin 2% 225
  5. 5 WP Engine 1.6% 179
  6. 6 PleskLin 1% 116
  7. 7 — 0.5% 51
  8. 8 Express 0.4% 47
  9. 9 Nuxt 0.3% 33
  10. 10 NIMHOST 0.2% 17

Share of 11,322 sites in the sample.

Our crawler: 11,322 sites · United Kingdom · updated 13 Nov 2026 · Methodology

Messy data?

Send a sample — we reply within one business day with an approach and a quote.

Get in touchServices