Security headers on 4,688 small-business websites: 49.7% met none of 7 criteria

A 2026 study of 7,040 directory-listed U.S. local-business websites: which security headers they send, and which they get wrong.

By RACKCRUNCH Team Scans 2026-09-24 Also available as a PDF (security-headers-study-2026.pdf, 400 KB, SHA-256 c8fa6a281799ff1f86c79b62f5ba5b52535a4ca9d9b6bdce69d61f5bfaeb6d91 ) .

Study version 7.4.2, reproduction pack v2.5.1. Scans 2026-09-24. See errata , how to cite and artifact hashes .

Definitions used throughout this report and every released file

RACKCRUNCH has a free Security Header Check . You give it a URL, it makes one request, and it tells you which response headers are set, which are set badly, and which are missing.

Checking one site at a time made us curious about the bigger picture. We didn't mean banks or big tech. We meant the plumber, the law office, the car lot, the pizza place: businesses that may lack dedicated web-security staff.