the security-header gap · 2026 edition

The Web Security Baseline · 2026

Name: The Web Security Baseline · 2026
Creator: Legit.Show
Published: 2026-07-22T13:00:00+00:00

We checked the public security posture of 1000 launched web apps, SaaS and AI tools on Legit.Show — the headers and policies a browser sees before you ever sign in. Most ship without the basics.

80%

ship with no Content-Security-Policy

across 1000 web apps we measured · according to Legit.Show · 2026

The findings

No Content-Security-Policy — 80%
The browser can’t block injected scripts — the front line against XSS is simply off.
No privacy policy page — 46%
No privacy policy reachable at a standard path — required almost everywhere they operate.
No structured data — 43%
No schema.org markup — invisible to AI answers and rich search results.
No HSTS — 41%
No Strict-Transport-Security — leaves a window for protocol-downgrade attacks.
Tracking without consent — 33%
Non-essential trackers fire before any consent — the real ePrivacy/GDPR violation (a missing banner is not). Measured as consent integrity, not banner presence.
Accessibility below 90 — 30%
Parts of the product are unusable with a screen reader or keyboard.
No real 404 page — 17%
Returns “200 OK” for pages that don’t exist — confuses crawlers and hides broken links.

How many of the 7 do they pass

6–7 passed — 6%
4–5 passed — 42%
2–3 passed — 47%
0–1 passed — 6%

By category

Productivity — 79% no Content-Security-Policy
AI & Agents — 83% no Content-Security-Policy
Developer Tools — 82% no Content-Security-Policy
Business & Finance — 78% no Content-Security-Policy
Other — 87% no Content-Security-Policy
Lifestyle & Other — 75% no Content-Security-Policy

What this measures

These are public-surface checks — what any browser or crawler sees from the outside, before login. They measure hygiene, not whether the product is good. Every number is a share of 1000 tested web services as of 2026-07-26.

Headers, not vibes

A CSP, HSTS and a real 404 cost minutes to add and are the line between “looks done” and “is done.” That 80% ship without even a CSP isn’t a story about bad engineers — it’s what a demo never forces you to add. Only 6% pass 6 or 7 of the seven.

A health check, not a grade

Surface signals correlate with care; they don’t prove a product is secure inside. We show exactly what was observed from the public surface, and what wasn’t — no overall score, no verdict.

Sample composition

Not a random sample — this is what we measured. The mix below is the caveat; judge it for yourself.

Productivity: 237
AI & Agents: 180
Developer Tools: 143
Business & Finance: 124
Other: 75
Lifestyle & Other: 59
Largest single maker: 0% (colorlibhq, 2)

What we measured (1000)

The full list, so anyone can spot-check. Every item links to its public benchmark.

How this was measured →