By The Numbers
0.4% — Only 0.4% of 19,251 recent security header checks on small-business WordPress sites achieved a "Good" configuration (all required browser security headers present and correct).
Biggest Risk
Missing Browser Security Headers:
Of 19,251 graded scans across small-business WordPress sites, 99.6% lacked at least one critical browser security header (CSP, X-Frame-Options, X-Content-Type-Options, or Referrer-Policy). "Good" outcomes required all four to be present and correctly configured.
| Grade | Sites | % of Sites |
|---|---|---|
| A | 338 | 0.5% |
| B+ | 994 | 1.5% |
| B | 532 | 0.8% |
| C+ | 17,322 | 25.5% |
| C | 6,328 | 9.3% |
| D | 20,186 | 29.7% |
| F | 15,219 | 22.4% |
<sub>Statistical context: Results reflect 19,251 graded scans of unique small-business WordPress sites between October 2 and November 1, 2026. These findings identify a configuration gap, not a confirmed compromise.</sub>
Industry Spotlight
WordPress Sites Lag on Security Headers:
Most WordPress sites serving small businesses are missing multiple browser-level protections. Adding just two headers (X-Frame-Options and X-Content-Type-Options) can quickly improve baseline risk posture.
Fix In Under 5 Minutes
Action:
Use a security header scan to check your site's current configuration. Start by adding X-Frame-Options (SAMEORIGIN) and X-Content-Type-Options (nosniff) to your site's server or through a plugin—these rarely affect site functionality and are widely supported.
Full Report
Read the full ThreatSpot Security Headers Research
<sub>For details on browser headers and technical references, see: