Security headers on 4,688 small-business websites: 49.7% met none of 7 criteria

In one line

We scanned 7,040 directory-listed U.S. local-business websites for security headers. Half met none of seven criteria. Full report, data and code.

Opening excerpt

A 2026 study of 7,040 directory-listed U.S. local-business websites: which security headers they send, and which they get wrong.

By RACKCRUNCH Team · Scans 2026-09-24 · Also available as a PDF (security-headers-study-2026.pdf, 400 KB, SHA-256 c8fa6a281799ff1f86c79b62f5ba5b52535a4ca9d9b6bdce69d61f5bfaeb6d91 ) .

RACKCRUNCH has a free Security Header Check . You give it a URL, it makes one request, and it tells you which response headers are set, which are set badly, and which are missing.

Checking one site at a time made us curious about the bigger picture. We didn’t mean banks or big tech. We meant the plumber, the law office, the car lot, the pizza place: businesses that may lack dedicated web-security staff.

(Excerpted from the original; full article via the source link below.)

This story hit the Hacker News front page today (14 points / 5 comments, via rackcrunch.com). Our Tech Radar aggregates daily signals on AI engineering, backend architecture and DevOps — browse the related services and further reading below, or get in touch with our team.