Hacker News: rackcrunch

New comment by rackcrunch in "Security headers on 4,688 small-business websites: 49.7% met none of 7 criteria"

rackcrunch — Thu, 24 Sep 2026 22:10:32 +0000

Fair. The study is backed by a human being who stands behind every number. And absolutely, use whatever tool you like.

New comment by rackcrunch in "Security headers on 4,688 small-business websites: 49.7% met none of 7 criteria"

rackcrunch — Thu, 24 Sep 2026 21:58:27 +0000

Referrer-Policy shows it can work. When the header is missing, browsers fall back to strict-origin-when-cross-origin. 86.6% of the sites we scanned don't send it, and we didn't count that as a failure for that reason. The other headers don't have a safe default like that yet.

New comment by rackcrunch in "Security headers on 4,688 small-business websites: 49.7% met none of 7 criteria"

rackcrunch — Thu, 24 Sep 2026 21:58:18 +0000

Thanks, glad it helped!