Derechos

We measured six widely recommended HTTP security response headers on 500 websites declared by French public administrations, on 14 August 2026. The full dataset, including the scanning script, is published openly under DOI 10.5281/zenodo.21948938 so anyone can check the numbers or extend the measurement.

The headline result: of the 481 sites that answered, 246 - 51.1% - sent none of the six headers. Only 33 sites, 6.9%, sent all six.

That contrast matters because the same sites have largely solved the harder problem. 94% of them ended on HTTPS. Encryption in transit, which required certificates, renewals and redirects, is essentially done. The headers, which require one line of server configuration each, are not.

Header by header: Strict-Transport-Security 34.1%, X-Content-Type-Options 30.8%, X-Frame-Options 26.2%, Referrer-Policy 20.2%, Content-Security-Policy 14.3%, Permissions-Policy 12.5%. The ordering is itself informative - the oldest and simplest headers are the most deployed, and the two that require thinking about what the site actually loads are the least.

Now the part that keeps this honest. A missing security header is not a vulnerability. Nothing here says these sites are compromised, or that any specific attack works against them. These headers are defence in depth: they reduce the damage of a flaw that already exists elsewhere. A site with no CSP is not breached; it simply has one fewer barrier if something else goes wrong.

What the numbers do measure is the distance between a baseline that costs almost nothing and the reality of deployment at scale. Referrer-Policy, for instance, controls how much of the visited URL is passed to third parties. On a public service page - a benefits application, a health form, a legal aid enquiry - the URL itself can be sensitive. It is present on one site in five.

The method, stated plainly so it can be criticised: URLs come from the DILA's Service-public.fr directory, published under Licence Ouverte, snapshot of 14 August 2026. We removed URLs pointing at third-party platforms - Facebook, Instagram, YouTube, X, shared blogging hosts - because measuring those would measure the platform rather than the public service. That removed 22 290 of 65 574 URLs. After deduplication by host, 27 434 distinct hosts remained, from which we took a systematic sample of 500.

The limits are equally plain. It is a sample, not a census. It was taken on a single day, from a single location, and a header may be present on some pages and absent on others - we measured the declared homepage. Some sites are hosted by shared providers, so the results describe the provider as much as the administration. And a site can be well secured without these headers, just as it can send all six and be badly built.

We are publishing this because the data did not appear to exist in open form, and because the fix is unusually cheap. Adding the six headers on a typical web server is a configuration change, not a project. If you run a public site and want to check yours, the script in the dataset does exactly what we did, on whatever list you give it.

The dataset is CC BY 4.0. If you use it, cite the DOI - and if you find an error in our method, we would rather correct the record than defend it.