Security headers · UK companies
What share of UK companies have no HSTS or Content-Security-Policy header?
73.94% of UK companies (95% CI 71.98–75.81%), measured across 2,007 companies on 2026-08-13.
Measured every Thursday since 2026-08-01 — 6 observations to date. Last measured 2026-08-13.
How this is measured
Tier 3a; check Strict-Transport-Security, Content-Security-Policy, X-Frame-Options on the homepage response. Denominator: has_web.
Passive measurement: a single DNS lookup, TLS handshake, or homepage GET per domain. Aggregate-only; no individual company is named. 95% Wilson confidence intervals. Population: national company registries (Companies House, Brreg, SIRENE), sampled by size band and resolved to email-active domains. Parked domains excluded. Snapshot: uk-companies-house-per600-seed20260728.
Licensed CC BY 4.0 — reuse with attribution to Quiet Failures. Download: JSON · CSV.
Why it matters
HSTS is what stops the first, downgradeable request; CSP is what limits the damage of injected script. Both are one-line changes, and both are commonly switched off silently by a framework upgrade or a proxy change.
The same check, other segments
- Russia (domains)95.45%
- Israel (domains)94.81%
- Slovenia (domains)94.57%
- South Korea (domains)93.67%
- Japan (domains)93.56%
- Lithuania (domains)92.51%
- Italy (domains)92.06%
- Brazil (domains)91.83%
Show the remaining 65 segments
- Turkey (domains)91.2%
- Indonesia (domains)91.18%
- Hungary (domains)90.78%
- Czechia (domains)90.48%
- Sweden (domains)90.14%
- Croatia (domains)89.61%
- Spain (domains)89.3%
- Bulgaria (domains)88.7%
- Greece (domains)88.63%
- South Africa (domains)88.56%
- Austria (domains)88.53%
- Thailand (domains)88.52%
- Malaysia (domains)88.35%
- Hong Kong (domains)88.26%
- Slovakia (domains)88.03%
- Ukraine (domains)87.68%
- Romania (domains)87.65%
- Argentina (domains)87.62%
- Chile (domains)87.34%
- Peru (domains)87.26%
- Latvia (domains)87.01%
- global domains86.62%
- Denmark (domains)86.44%
- the EU (domains)86.41%
- France (domains)86.4%
- Germany (domains)85.93%
- Belgium (domains)85.66%
- Switzerland (domains)85.61%
- Norway micro companies84.91%
- Finland (domains)84.8%
- Poland (domains)84.75%
- Ireland (domains)84.43%
- the UK (domains)84.02%
- the Netherlands (domains)83.58%
- Iceland (domains)83.57%
- Luxembourg (domains)83.53%
- Estonia (domains)83.39%
- Australia (domains)83.14%
- France micro companies82.99%
- India (domains)82.94%
- Vietnam (domains)82.88%
- Portugal (domains)82.82%
- New Zealand (domains)82.04%
- the UAE (domains)81.9%
- Mexico (domains)81.6%
- Saudi Arabia (domains)81.43%
- Singapore (domains)81.17%
- Taiwan (domains)80.65%
- Norway (domains)80.17%
- the Philippines (domains)79.73%
- UK dormant companies77.93%
- UK micro companies77.66%
- the US (domains)77.23%
- Canada (domains)77.04%
- Norway small companies76.85%
- France medium companies76.23%
- UK small companies75.2%
- France companies74.22%
- France small companies74.12%
- Norway companies72.84%
- UK medium & large companies71.54%
- UK newly-formed (no accounts filed) companies71.52%
- Norway medium companies70.32%
- France large companies59.62%
- Norway large companies51.72%