Security headers across 188 sites
Response headers as sent to any visitor, scanned on 2026-08-04. Useful for seeing what real policies look like — including at organisations you would expect to get this right.
Point-in-time snapshots. Headers change; the scanner on any of these pages
re-checks live.
Developer platforms and infrastructure
| Site | Grade | CSP | HSTS |
|---|---|---|---|
| github.com | A | allowlist | yes |
| pypi.org | A | nonce | yes |
| developer.mozilla.org | A | nonce | yes |
| postman.com | B | none | yes |
| sentry.io | B | nonce | yes |
| python.org | B | none | yes |
| golang.org | B | nonce | yes |
| kernel.org | C | allowlist | yes |
| circleci.com | C | none | yes |
| whatwg.org | C | none | yes |
| nodejs.org | C | none | yes |
| docker.com | D | none | yes |
| terraform.io | D | none | yes |
| cloudflare.com | D | allowlist | yes |
| vercel.com | D | allowlist | yes |
| netlify.com | D | none | yes |
| fastly.com | D | none | yes |
| jetbrains.com | D | none | yes |
| newrelic.com | D | allowlist | yes |
| mozilla.org | D | allowlist | yes |
| gitlab.com | D | none | yes |
| kubernetes.io | D | none | yes |
| digitalocean.com | D | none | no |
| linode.com | D | allowlist | yes |
| datadoghq.com | D | allowlist | yes |
| atlassian.com | D | allowlist | yes |
| jira.com | D | allowlist | yes |
| sourceforge.net | D | allowlist | yes |
| bitbucket.org | D | allowlist | yes |
| w3.org | D | allowlist | yes |
| php.net | D | none | yes |
| rust-lang.org | F | none | no |
| ruby-lang.org | F | none | no |
| heroku.com | F | allowlist | yes |
Security and privacy
| Site | Grade | CSP | HSTS |
|---|---|---|---|
| haveibeenpwned.com | A | nonce | yes |
| cisa.gov | A | none | yes |
| 1password.com | A | nonce | yes |
| snyk.io | B | allowlist | yes |
| cve.org | B | none | yes |
| malwarebytes.com | B | none | yes |
| sonarsource.com | C | nonce | yes |
| bitdefender.com | C | nonce | yes |
| ssllabs.com | C | nonce | yes |
| hackerone.com | C | allowlist | yes |
| torproject.org | C | nonce | yes |
| owasp.org | D | allowlist | yes |
| sophos.com | D | allowlist | yes |
| proton.me | D | allowlist | yes |
| eff.org | D | none | no |
| bugcrowd.com | D | none | yes |
| rapid7.com | D | allowlist | yes |
| crowdstrike.com | D | allowlist | yes |
| paloaltonetworks.com | D | allowlist | yes |
| fortinet.com | D | allowlist | yes |
| kaspersky.com | D | allowlist | yes |
| bitwarden.com | D | allowlist | yes |
| signal.org | D | none | no |
| nist.gov | F | allowlist | yes |
| tenable.com | F | allowlist | yes |
| eset.com | F | allowlist | yes |
| privacyguides.org | F | allowlist | yes |
| letsencrypt.org | F | allowlist | yes |
SaaS and productivity
| Site | Grade | CSP | HSTS |
|---|---|---|---|
| stripe.com | A | nonce | yes |
| calendly.com | B | none | yes |
| linear.app | B | allowlist | yes |
| docusign.com | C | none | yes |
| slack.com | C | none | yes |
| figma.com | C | allowlist | yes |
| twilio.com | C | none | yes |
| okta.com | C | none | yes |
| loom.com | C | none | yes |
| trello.com | C | none | yes |
| hubspot.com | C | nonce | yes |
| dropbox.com | D | allowlist | yes |
| monday.com | D | none | yes |
| airtable.com | D | none | yes |
| salesforce.com | D | none | yes |
| intercom.com | D | allowlist | yes |
| smartsheet.com | D | none | yes |
| shopify.com | D | none | yes |
| zoom.us | D | none | yes |
| asana.com | D | allowlist | yes |
| zapier.com | D | allowlist | yes |
| auth0.com | D | allowlist | yes |
| clickup.com | D | allowlist | yes |
| grammarly.com | D | allowlist | yes |
| mailchimp.com | D | none | yes |
| basecamp.com | D | none | no |
| notion.so | F | allowlist | yes |
| zendesk.com | F | allowlist | no |
| miro.com | F | allowlist | yes |
| box.com | F | allowlist | yes |
Banking and finance
| Site | Grade | CSP | HSTS |
|---|---|---|---|
| wellsfargo.com | A | nonce | yes |
| adyen.com | A | nonce | yes |
| klarna.com | A | nonce | yes |
| paypal.com | A | nonce | yes |
| monzo.com | A | nonce | yes |
| squareup.com | A | none | yes |
| fidelity.com | B | none | yes |
| capitalone.com | C | none | yes |
| ing.com | C | none | yes |
| kraken.com | C | none | yes |
| wise.com | D | allowlist | yes |
| lloydsbank.com | D | none | yes |
| robinhood.com | D | allowlist | yes |
| xero.com | D | none | no |
| bankofamerica.com | D | allowlist | yes |
| citi.com | D | allowlist | yes |
| visa.com | D | allowlist | yes |
| hsbc.com | D | allowlist | yes |
| natwest.com | D | allowlist | yes |
| santander.com | D | allowlist | yes |
| vanguard.com | D | none | yes |
| quickbooks.com | F | allowlist | yes |
| schwab.com | F | none | no |
| chase.com | F | allowlist | yes |
| discover.com | F | allowlist | yes |
| amex.com | F | allowlist | no |
Retail and ecommerce
| Site | Grade | CSP | HSTS |
|---|---|---|---|
| ikea.com | B | allowlist | yes |
| ebay.com | C | none | yes |
| nordstrom.com | C | none | yes |
| target.com | D | allowlist | yes |
| wix.com | D | none | yes |
| woocommerce.com | D | allowlist | yes |
| squarespace.com | D | none | yes |
| walmart.com | F | allowlist | yes |
| bestbuy.com | F | none | yes |
| wayfair.com | F | allowlist | yes |
| nike.com | F | allowlist | yes |
| zalando.com | F | allowlist | yes |
| bigcommerce.com | F | allowlist | yes |
| amazon.com | F | none | no |
| aliexpress.com | F | none | no |
Media and social
| Site | Grade | CSP | HSTS |
|---|---|---|---|
| pinterest.com | A | nonce | yes |
| netflix.com | B | none | yes |
| reddit.com | B | nonce | yes |
| discord.com | B | nonce | yes |
| bbc.co.uk | B | nonce | yes |
| youtube.com | C | nonce | yes |
| tumblr.com | C | nonce | yes |
| vimeo.com | C | none | yes |
| linkedin.com | C | allowlist | yes |
| telegram.org | C | none | yes |
| goodreads.com | C | none | yes |
| spotify.com | C | nonce | yes |
| twitch.tv | D | none | yes |
| soundcloud.com | D | none | yes |
| theguardian.com | D | allowlist | yes |
| wikipedia.org | D | none | yes |
| imdb.com | D | none | yes |
| archive.org | D | nonce | yes |
| patreon.com | D | none | yes |
| substack.com | D | allowlist | yes |
| nytimes.com | F | allowlist | yes |
| cnn.com | F | allowlist | no |
Government and public sector
| Site | Grade | CSP | HSTS |
|---|---|---|---|
| rijksoverheid.nl | A | nonce | yes |
| gov.uk | A | nonce | yes |
| bund.de | A | nonce | yes |
| usa.gov | B | none | yes |
| europa.eu | B | none | yes |
| nasa.gov | C | none | yes |
| noaa.gov | C | none | yes |
| ftc.gov | C | none | yes |
| nhs.uk | C | none | yes |
| canada.ca | C | none | yes |
| un.org | C | none | yes |
| worldbank.org | C | none | yes |
| cdc.gov | D | none | yes |
| usps.com | D | allowlist | yes |
| australia.gov.au | D | allowlist | yes |
| sec.gov | D | allowlist | yes |
| who.int | F | allowlist | yes |
Universities
| Site | Grade | CSP | HSTS |
|---|---|---|---|
| stanford.edu | B | nonce | yes |
| tudelft.nl | B | nonce | yes |
| epfl.ch | C | none | yes |
| yale.edu | C | none | yes |
| imperial.ac.uk | D | allowlist | yes |
| cam.ac.uk | D | allowlist | yes |
| ucl.ac.uk | D | allowlist | yes |
| ethz.ch | D | allowlist | yes |
| berkeley.edu | D | none | no |
| princeton.edu | D | none | no |
| jstor.org | D | none | no |
| harvard.edu | F | none | no |
| cornell.edu | F | none | no |
| nature.com | F | none | no |
| mit.edu | F | allowlist | yes |
| arxiv.org | F | allowlist | no |