the security-header gap · 2026 edition

The Web Security Baseline · 2026

Name: The Web Security Baseline · 2026
Creator: Legit.Show
Published: 2026-07-22T13:00:00+00:00

We checked the public security posture of 6639 launched web apps, SaaS and AI tools on Legit.Show — the headers and policies a browser sees before you ever sign in. Most ship without the basics.

76%

ship with no Content-Security-Policy

across 6639 web apps we measured · according to Legit.Show · 2026

The findings

No Content-Security-Policy — 76%
The browser can’t block injected scripts — the front line against XSS is simply off.
No HSTS — 39%
No Strict-Transport-Security — leaves a window for protocol-downgrade attacks.
No privacy policy page — 38%
No privacy policy reachable at a standard path — required almost everywhere they operate.
Tracking without consent — 36%
Non-essential trackers fire before any consent — the real ePrivacy/GDPR violation (a missing banner is not). Measured as consent integrity, not banner presence.
No structured data — 33%
No schema.org markup — invisible to AI answers and rich search results.
Accessibility below 90 — 23%
Parts of the product are unusable with a screen reader or keyboard.
No real 404 page — 15%
Returns “200 OK” for pages that don’t exist — confuses crawlers and hides broken links.

How many of the 7 do they pass

6–7 passed — 21%
4–5 passed — 51%
2–3 passed — 26%
0–1 passed — 2%

By category

Productivity — 77% no Content-Security-Policy
AI & Agents — 78% no Content-Security-Policy
Business & Finance — 71% no Content-Security-Policy
Developer Tools — 75% no Content-Security-Policy
Lifestyle & Other — 75% no Content-Security-Policy
Other — 83% no Content-Security-Policy

What this measures

These are public-surface checks — what any browser or crawler sees from the outside, before login. They measure hygiene, not whether the product is good. Every number is a share of 6639 tested web services as of 2026-08-13.

Headers, not vibes

A CSP, HSTS and a real 404 cost minutes to add and are the line between “looks done” and “is done.” That 76% ship without even a CSP isn’t a story about bad engineers — it’s what a demo never forces you to add. Only 21% pass 6 or 7 of the seven.

A health check, not a grade

Surface signals correlate with care; they don’t prove a product is secure inside. We show exactly what was observed from the public surface, and what wasn’t — no overall score, no verdict.

Sample composition

Not a random sample — this is what we measured. The mix below is the caveat; judge it for yourself.

Productivity: 1630
AI & Agents: 1256
Business & Finance: 928
Developer Tools: 795
Lifestyle & Other: 432
Other: 408
Largest single maker: 0% (modelcontextprotocol, 3)

What we measured (6639)

The full list, so anyone can spot-check. Every item links to its public benchmark.

How this was measured →