Security headers · UK newly-formed (no accounts filed) companies

What share of UK newly-formed (no accounts filed) companies have no HSTS or Content-Security-Policy header?

71.52%

71.52% of UK newly-formed (no accounts filed) companies (95% CI 64.04–77.98%), measured across 158 companies on 2026-08-13.

strong: 28.48%partial: 18.99%missing: 52.53%
strong · 28.48%partial · 18.99%missing · 52.53%
Trend

Measured every Thursday since 2026-08-01 — 6 observations to date. Last measured 2026-08-13.

How this is measured

Tier 3a; check Strict-Transport-Security, Content-Security-Policy, X-Frame-Options on the homepage response. Denominator: has_web.

Passive measurement: a single DNS lookup, TLS handshake, or homepage GET per domain. Aggregate-only; no individual company is named. 95% Wilson confidence intervals. Population: national company registries (Companies House, Brreg, SIRENE), sampled by size band and resolved to email-active domains. Parked domains excluded. Snapshot: uk-companies-house-per600-seed20260728.

Licensed CC BY 4.0 — reuse with attribution to Quiet Failures. Download: JSON · CSV.

Why it matters

HSTS is what stops the first, downgradeable request; CSP is what limits the damage of injected script. Both are one-line changes, and both are commonly switched off silently by a framework upgrade or a proxy change.

The same check, other segments

Show the remaining 65 segments

Share or cite this figure

Reuse is free under CC BY 4.0 — attribution to Quiet Failures is all we ask.

Post on X

Embed this stat

Free to reuse under CC BY 4.0 — the card links back and updates as the data does.

<iframe src="https://quietfailures.com/embed/security-headers/gb-no-accounts" width="380" height="210" style="border:0;max-width:100%" loading="lazy" title="What share of UK newly-formed (no accounts filed) companies have no HSTS or Content-Security-Policy header?"></iframe>