the security-header gap · 2026 edition

The Web Security Baseline · 2026

Name: The Web Security Baseline · 2026
Creator: Legit.Show
Published: 2026-07-22T13:00:00+00:00

We checked the public security posture of 13666 launched web apps, SaaS and AI tools on Legit.Show — the headers and policies a browser sees before you ever sign in. Most ship without the basics.

75%

ship with no Content-Security-Policy

across 13666 web apps we measured · according to Legit.Show · 2026

The findings

No Content-Security-Policy — 75%
The browser can’t block injected scripts — the front line against XSS is simply off.
No HSTS — 40%
No Strict-Transport-Security — leaves a window for protocol-downgrade attacks.
No privacy policy page — 39%
No privacy policy reachable at a standard path — required almost everywhere they operate.
Tracking without consent — 34%
Non-essential trackers fire before any consent — the real ePrivacy/GDPR violation (a missing banner is not). Measured as consent integrity, not banner presence.
No structured data — 33%
No schema.org markup — invisible to AI answers and rich search results.
Accessibility below 90 — 19%
Parts of the product are unusable with a screen reader or keyboard.
No real 404 page — 16%
Returns “200 OK” for pages that don’t exist — confuses crawlers and hides broken links.

How many of the 7 do they pass

6–7 passed — 21%
4–5 passed — 50%
2–3 passed — 27%
0–1 passed — 3%

By category

Productivity — 74% no Content-Security-Policy
AI & Agents — 76% no Content-Security-Policy
Business & Finance — 71% no Content-Security-Policy
Developer Tools — 74% no Content-Security-Policy
Lifestyle & Other — 75% no Content-Security-Policy
Other — 84% no Content-Security-Policy

What this measures

These are public-surface checks — what any browser or crawler sees from the outside, before login. They measure hygiene, not whether the product is good. Every number is a share of 13666 tested web services as of 2026-09-27.

Headers, not vibes

A CSP, HSTS and a real 404 cost minutes to add and are the line between “looks done” and “is done.” That 75% ship without even a CSP isn’t a story about bad engineers — it’s what a demo never forces you to add. Only 21% pass 6 or 7 of the seven.

A health check, not a grade

Surface signals correlate with care; they don’t prove a product is secure inside. We show exactly what was observed from the public surface, and what wasn’t — no overall score, no verdict.

Sample composition

Not a random sample — this is what we measured. The mix below is the caveat; judge it for yourself.

Productivity: 3407
AI & Agents: 2370
Business & Finance: 2021
Developer Tools: 1717
Lifestyle & Other: 986
Other: 731
Largest single maker: 0% (play.google.com, 32)

What we measured (13666)

The full list, so anyone can spot-check. Every item links to its public benchmark.

How this was measured →