No security headers
45.6%
of the 3,044 free scans considered in the last 30 days raised this finding. That is 1,388 scans across 1,380 distinct sites. 95% interval 43% to 48.2%.
What it means
Baseline headers like Content-Security-Policy and X-Content-Type-Options are a site’s own instructions to the browser about what to refuse.
How to fix it
Add X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin and a Content-Security-Policy. The first two are one line each and break nothing.
How to check it yourself
Run curl -sI https://example.com and look for X-Content-Type-Options and Content-Security-Policy in the response headers. Missing lines mean the header is not set.
What fixed looks like
The curl response headers include X-Content-Type-Options, Referrer-Policy and a Content-Security-Policy line.
How we measured this
Go Voltic scans a site and records which findings it raises. The share above is over every free four-page scan in the last 30 days that loaded at least one page, which is 3,044 scans. Deep scans of paid reports and of the research sweep read a site at a different depth and are a separate population, never in this denominator. It is not a survey and it is not an estimate: it is a count of what our own scanner found. Sites are counted once each in the distinct-sites figure, so a site scanned twice does not weigh double there.
The interval is a 95% Wilson interval. A share printed without its sample size reads as certainty and is indistinguishable from a guess, so both are always shown. Figures on this page were computed on 2026-09-08.
The same share sits beside every other finding on the benchmarks page, which also carries the whole table as CSV and JSON and says how to cite it.
Check your own site
The free scan reads four pages and reports every finding it raises, including this one. It takes about ten seconds and asks for nothing but the address.