What 215 Sites Forget: 30% Send No Security Headers

Site security often comes down to small settings nobody got round to switching on: a missing header, an unprotected mail domain, a plugin that has not been updated for a year. We looked at what 215 sites checked by our free scanner PromoPilot Shield had in common, and the picture is more ordinary, and more fixable, than you might expect.

Data: scans from 16.07–06.11.2026, updated 06.11.2026

About the sample

These are 215 unique sites whose owners or specialists submitted them to Shield between 16 July and 6 November 2026. The sample is not random, so everything below describes our sample, not the internet as a whole. Details are in the Methodology section at the end.

Security headers: the cheapest protection that sites skip

Security headers are short instructions your server sends to the browser with every page. They cost nothing and usually take one config line each. Here is what the six we checked do:

• Strict-Transport-Security (HSTS) tells browsers to always use HTTPS for your domain, which helps prevent downgrade attacks.
• Content-Security-Policy (CSP) lists the sources a page may load scripts from, limiting the damage of injected code.
• X-Frame-Options stops other sites from embedding your pages in a hidden frame (clickjacking).
• X-Content-Type-Options forbids browsers from guessing file types, which closes one route for disguised scripts.
• Referrer-Policy controls how much of your page address is passed to other sites.
• Permissions-Policy switches off browser features, such as camera or geolocation, that your pages do not need.

Missing headers tend to come in bundles. The most common single result was having none of the six: 65 sites. The second most common was having all six: 38 sites. In between, 22 sites miss one, 26 miss two, 13 miss three, 15 miss four and 36 miss five. In other words, sites rarely add headers one by one: they either have a deliberate configuration or nothing at all.

HSTS is the most widely deployed of the six and is still missing on 46% of sites (99 of 215). Content-Security-Policy is hardest to get right, so its 65% (140 of 215) is understandable, but the simpler headers have no such excuse.

Email: who can send mail in your name

Email records live in DNS, not on the website, which is why they are so often forgotten. SPF lists the servers allowed to send mail for your domain. DMARC tells receiving servers what to do with messages that fail the check. Without both, anyone can send an email that looks as if it came from you.

In our sample 49% of domains (105 of 215) had no DMARC record. A further 33% (71) had one set to p=none, which only collects reports and blocks nothing. That makes 82% (176 of 215) without strict DMARC (strict DMARC: p=quarantine or p=reject). SPF was missing at 28% (60 of 215). For a business the consequence is concrete: fake invoices or password-reset emails sent to your customers under your domain name, and your real emails more likely to land in spam.

Two other records came up as missing almost everywhere: CAA (93%, 200 of 215) and MTA-STS (71%, 152 of 215). CAA limits which authorities may issue certificates for your domain; MTA-STS forces encrypted delivery of incoming mail. Both are worth having, but the risk is low for a typical small site. We would fix DMARC long before either.

WordPress versus everything else

WordPress sites in our sample (n=50) look noticeably different from the other 165 sites.

This is not a verdict on WordPress itself. It is the most popular CMS in the world, so it is also the most studied: the open WordPress vulnerability database our scanner relies on holds 1,797 entries for plugins and 84 for themes. The matches come from outdated versions of plugins, themes and core. One caveat on the 4%: the scanner has a detailed vulnerability database for WordPress plugins and themes, while for other platforms it checks mainly JavaScript libraries and server software, so the gap partly reflects what we can see, not only how safe each platform is.

Keep in mind what "vulnerable component" means here: the installed version falls into a range listed in the database. We did not test whether the flaw can actually be exploited on that site.

Cookies and version disclosure

Cookies and server banners are the small details that help an attacker prepare. Across all 215 sites:

• 21% (45) set cookies without HttpOnly, so scripts on the page can read them;
• 16% (35) set cookies without Secure, so they may travel over plain HTTP;
• 19% (40) set cookies without SameSite, which weakens protection against cross-site requests;
• 17% (36) send an X-Powered-By header with a version, and 11% (24) show the server version in a header;
• 6% (13) do not redirect HTTP visitors to HTTPS.

None of these is a breach on its own. Together they save an attacker time, and they take minutes to close.

A 30-minute checklist

1. Add five headers now, CSP separately (next step). Nginx example (inside the server block):

   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
   add_header X-Frame-Options "SAMEORIGIN" always;
   add_header X-Content-Type-Options "nosniff" always;
   add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

   Apache (.htaccess):

   Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
   Header always set X-Frame-Options "SAMEORIGIN"
   Header always set X-Content-Type-Options "nosniff"
   Header always set Referrer-Policy "strict-origin-when-cross-origin"
   Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

   Add Content-Security-Policy last, first as Content-Security-Policy-Report-Only, because it can break scripts you rely on.
2. Publish an SPF record that lists only the services that really send your mail.
3. Publish DMARC. Start with p=none and a reporting address, read the reports for a couple of weeks, then move to quarantine and finally reject.
4. Update plugins, themes and the core, and delete everything you do not use.
5. Hide the CMS version and remove X-Powered-By (expose_php = Off removes PHP's X-Powered-By, server_tokens off hides the Nginx version).
6. Set HttpOnly, Secure and SameSite on session cookies.
7. Redirect all HTTP traffic to HTTPS with a permanent redirect.

Test the result after each change, because a wrong header can break embeds, payment widgets or analytics.

Check your own site

You can see where your site stands with a free scan in PromoPilot Shield (promopilot.link/en/security/). It is a passive check and a starting point, not protection by itself: fixing what it finds is still up to you.

Methodology

• Source: scans by the free PromoPilot Shield scanner from 16.07.2026 to 06.11.2026. The scanner is passive: it reads server responses, DNS and the HTML of the homepage and a limited set of URLs, with no intrusion attempts.
• Unit: a site (host without www), using its latest successful scan. 285 runs gave 272 successful ones and 218 unique sites; we excluded 3 (test accounts and PromoPilot sites), leaving 215.
• Platform: detected from response signs (generator, paths, headers): WordPress 50, Next.js 10, Shopify 7, Joomla, Wix and OpenCart 3 each; for 139 the platform is undetected or custom. We compare only WordPress (n=50) with all others (n=165), since other groups have fewer than 20 sites.
• Vulnerable component: the plugin, theme or core version matches a range in the open WordPress vulnerability database (1,797 plugin and 84 theme entries in our feed on 06.11.2026). It is a version match; exploitation was not tested.
• Six headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, counted as missing on the homepage.
• Email: SPF and DMARC read from the domain DNS. "Weak DMARC" means p=none or a record without a policy.
• Grades: the Shield scale A+ to E and a 0–100 score weigh findings by risk level.
• Limitations: the sample is not random: these are sites that owners or specialists chose to submit (self-selection). The numbers describe this sample, not the whole internet. By country: .com 84, .ua 24, others under 20, so we do not compare countries. We publish no domains, only aggregates for groups of 20 sites or more.

FAQ

Which security headers are essential?

There is no single mandatory list, but six headers cover the basics: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. HSTS and X-Content-Type-Options are the easiest to add and rarely break anything. Content-Security-Policy is the most powerful but needs testing, so start in report-only mode.

Why is a missing DMARC record dangerous?

Without DMARC, receiving mail servers have no instruction on what to do with messages that falsely claim to come from your domain. Attackers can send phishing emails to your customers that look like they came from you. In our sample 49% of domains (105 of 215) had no DMARC record and another 33% (71) had p=none, which only monitors and blocks nothing.

Is WordPress insecure by itself?

No. In our sample the difference is tied to plugin, theme and core versions, not to the platform as such. A plugin, theme or core version matched a known vulnerability on 30% of WordPress sites (15 of 50) versus 4% of other sites (7 of 165). Updating and removing unused plugins clears these matches. Part of the gap comes from the WordPress database being more detailed.

How can I check my own site?

Run a free scan in PromoPilot Shield: it reads your server responses, DNS records and homepage HTML passively and shows which headers, email records and disclosures are missing. You can also inspect headers with browser developer tools or curl -I, and check SPF and DMARC with any DNS lookup tool.

Do small sites need CAA and MTA-STS?

Usually they are a low priority. CAA was missing on 93% of sites (200 of 215) and MTA-STS on 71% (152 of 215), but the practical risk is low compared with missing DMARC, outdated plugins or absent HSTS. Add them once the basics are done, particularly if you handle sensitive email or payments.

How to cite

PromoPilot (2026). What Sites Forget: Security Settings in 215 Shield Checks. Data 16.07–06.11.2026. CC BY 4.0: https://promopilot.link/uploads/blog/research/site-security-0711/site-security-settings-2026-11-06.csv . Article: https://promopilot.link/en/blog/what-sites-forget-security-settings-215-checks

Download the data

The aggregate table (CSV, license CC BY 4.0): https://promopilot.link/uploads/blog/research/site-security-0711/site-security-settings-2026-11-06.csv. It contains percentages only, no domains.