We found that only 8 of 4,688 small business sites we scanned pass a real script-CSP check
Source Reddit Cybersecurity
Discussion
A 2026 study scanned 4,688 US small business websites and found that only 8 (0.17%) implemented a Content-Security-Policy (CSP) that effectively restricts scripts. Nearly half of the sites met none of seven basic security header criteria checked, including headers like HSTS, X-Content-Type-Options, and clickjacking protection. While many sites send some headers, the adoption of strong security headers is low, especially for script-restricting CSPs. The study highlights a widespread lack of basic HTTP security header adoption among small business websites, which represent a low-cost security layer. However, the absence of these headers does not necessarily prove sites are vulnerable or hackable, but indicates a missed opportunity for improving security posture.
r/cybersecurity (opens in a new tab)u/Plastic-Falcon91470 points0 comments
I'm part of the Rackcrunch team. We ran a header-only scan of 4,688 US small business websites, sampled from a public business directory. We only read HTTPS response headers. No page content, no probing, nothing invasive.
Short version: 49.7% met none of the seven basic header criteria we checked. 21.2% send an enforced Content-Security-Policy, but most of those are framing or upgrade rules only. Only 8 out of 4,688 (0.17%) passed our check for a CSP that actually restricts scripts.
None of this proves a site is hackable or vulnerabl. Headers are one layer. But they're the cheapest layer, a few lines of config, and half sites we looked at don't bother.
Full method, rubric and de-identified data here if you want to check our work: https://rackcrunch.com/security-headers-2026
Question/feedback requested: which headers are realistic to ask of a small business site? CSP is the obvious sticking point. Nobody wants to maintain one on a site they touch twice a year.