Nearly half of small business websites lack basic security headers

Study Overview

RACKCRUNCH conducted a study in 2026 examining the security header configurations of 7,040 directory-listed U.S. local business websites. The research aimed to understand the adoption of security headers among businesses that may not have dedicated web-security staff, such as plumbers, law offices, and local shops. The sample was drawn from the public Curlie web directory's U.S. local "Business and Economy" categories.

Methodology

The study involved running two HTTPS request-chain scans on each sampled URL, following up to three redirects. Response headers were read, but page content was not. The final analysis focused on 4,688 unique domains that provided a usable HTTP-200 response. The study defined seven specific security header criteria to evaluate each site's configuration.

Key Findings on Security Header Adoption

The study revealed that 49.7% of the 4,688 small business websites analyzed did not meet any of the seven defined security header criteria. This indicates a significant gap in the implementation of basic web security measures. While the study anticipated low adoption, the extent of non-compliance was a notable finding.

Implications for Small Businesses

The lack of security headers can leave websites vulnerable to common attacks like cross-site scripting (XSS), clickjacking, and other content injection exploits. For small businesses, this can lead to data breaches, reputational damage, and loss of customer trust. The findings highlight a need for increased awareness and easier implementation of fundamental web security practices in this sector.