No attacks. We only looked at what every visitor's browser receives, and we list the fixes for the most common gaps.
Big sites have security teams. Most of the web does not. We wanted to know what ordinary websites look like from the outside, not Google and Amazon, so we ran a passive check on 1,000 of them. If you want to run the same check on your own site, it is free and needs no sign-up: https://mcp.pasportoo.com/check?utm_source=devto
Method
- We took the open Tranco top-1M ranking and picked 1,000 domains at random (fixed seed) from those ranked below 10,000.
- We loaded the home page once, like a normal visitor, plus up to 10 of its own links to check for broken ones. No login, no hidden files, no forms.
- We publish totals only, never site names.
571 sites answered. Another 94 blocked automated checks and 335 did not answer. All shares below are of the 571.
What we found
| What | Share of sites |
|---|---|
| No Content-Security-Policy | 79% |
| Third-party scripts without Subresource Integrity | 64% |
| No HSTS | 61% |
| Can be framed by another site (clickjacking) | 58% |
No X-Content-Type-Options: nosniff | 53% |
Cookies without protective flags (Secure, HttpOnly) | 26% |
| Server software version disclosed in headers | 19% |
| No mobile viewport set | 11% |
| jQuery older than 3.5.0 (known vulnerabilities) | 9% |
| Broken links on the home page | 7% |
36% of sites were missing all four basic security headers at once: HSTS, CSP, frame protection and nosniff. 21% had at least one finding we rate as high severity, such as a vulnerable jQuery, a broken link, mixed content or an end-of-life PHP version.
These are gaps, not proof of a breach: a missing header does not mean a site has been or will be hacked.
For comparison, we ran the same check on 1,000 DeFi websites earlier: https://dev.to/alex_simakov_d5176f3977ad/we-checked-1000-defi-websites-76-have-no-csp-and-64-can-be-framed-by-another-site-5m5
The fixes
Most of these are server configuration, not code:
- Clickjacking:
Content-Security-Policy: frame-ancestors 'self'orX-Frame-Options: DENY. - HSTS:
Strict-Transport-Security: max-age=31536000; includeSubDomains, once all your subdomains serve HTTPS. - nosniff:
X-Content-Type-Options: nosniff. - CSP: start with
Content-Security-Policy-Report-Only, read the reports for a week, then enforce. - Third-party scripts: self-host them or add
integrity=andcrossorigin=. That does not work for scripts that change by design, such as most analytics tags; CSP covers those. - Cookies:
Secureon every cookie,HttpOnlyon session cookies. - Version disclosure:
server_tokens offin nginx,ServerTokens Prodin Apache,expose_php = Offin PHP. - Viewport:
<meta name="viewport" content="width=device-width, initial-scale=1">. - jQuery: upgrade to 3.5.0 or later.
Check your own site
The free check looks at your home page the same way, takes about 15 seconds, keeps no page content or results, and shows the top 3 issues with a fix for each: https://mcp.pasportoo.com/check?utm_source=devto
We are early and have no paying customers yet; if you want more than the home page, we also sell a $29 audit of up to 5 pages along one user journey on desktop and mobile, paid in USDT (TRC-20), where a person reviews every finding before delivery.
We would love to hear about false positives, in the comments or at work@pasportoo.com.
Method: Tranco top-1M list, seeded random sample of 1,000 domains ranked below 10,000, one home-page load each plus up to 10 same-site links, measured 7 November 2026 from one network. No per-site data is published.
Disclosure: this article was written with AI tools; every number was checked against our study data and code.
