Security headers on 4,688 small-business websites: 49.7% met none of 7 criteria

Nearly half of 4,688 small-business websites examined failed to meet any of seven key security header criteria, according to a 2026 RACKCRUNCH study of directory-listed U.S. local businesses. The research found extremely low adoption of important security headers like Content-Security-Policy, X-Frame-Options, and others, revealing significant security vulnerabilities among small businesses that typically lack dedicated web-security staff.