Security headers of 66 penetration testing providers' own websites
On 9 November 2026 we ran our security headers checker once on the homepage of each of the 66 pentest providers in the PentestCompare dataset. 65 returned a response we could grade. 69% pass the HSTS check, 35% send no Content-Security-Policy and 2 pass our CSP check, and 10 disclose a software version. Counts only, no ranking. The raw data is free to download.
We checked the security headers of the homepages of the 66 penetration testing providers in the PentestCompare dataset on 9 November 2026. 65 returned a response we could grade. 45 of the 65 set HSTS with a max-age of one year or more, and 2 send a Content-Security-Policy that passes our check. This page gives counts only. Per-provider rows are in the raw data.
Method#
The list is every provider in the PentestCompare dataset on 9 November 2026: 66 providers. For each one we checked the URL in its website field, as recorded. For 61 providers that is the homepage. For 5 it is a product page or a language page (for example a path such as /en/), and we checked it as given.
We sent each URL once to the live API behind our free security headers checker. The API allows 12 checks a minute from one address, so we spaced the calls 6.5 seconds apart. The run took from 23:09 to 23:17 UTC on 9 November 2026, from one machine. The checker runs on Cloudflare's network. It sends one GET request per redirect hop, up to 5 hops, with the user agent ExcessionLabsHeaderCheck/1.0. It reads response headers only, with an 8-second timeout per hop, and never reads or stores a page body. That is the same traffic as one browser visit to the page. No call needed a retry.
The checker grades 8 checks that we count in the pass totals: HTTPS, HSTS (max-age at least 31,536,000 seconds, one year), Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and version disclosure. It also records Cross-Origin-Opener-Policy, cookie flags, CORS and X-XSS-Protection, which we report apart from the totals. The rules follow the OWASP Secure Headers Project and MDN. They are the same rules as in our study of the top 1,000 websites.
Excession Labs publishes PentestCompare and has its own row in the dataset, marked "Publisher-owned". We own those sites, so we do not grade ourselves next to the others. The study covers the 66 other providers only.
What we got back#
| Outcome | Providers |
|---|---|
| Response graded | 65 |
| Not graded (refused by the checker's address rules) | 1 |
One homepage was not graded. Its name resolves to addresses in 192.0.78.0/24, and the checker treats the whole 192.0.0.0/16 block as reserved. The IANA special-purpose registry reserves only parts of that block (192.0.0.0/24 and 192.0.2.0/24), so this is a limit of our checker, not a fault of the site.
Of the 65 graded responses, 64 had a 2xx status and 1 had a 403, which is often a bot filter. An error page can carry other headers than the real page. 5 responses ended on a different host than the one we asked for. 3 of them only added or dropped www.. All 65 ended on https.
Results#
Percentages use the 65 graded responses as the denominator. With 65 sites, one site moves a share by about 1.5 points.
| Check | Pass | Share of 65 |
|---|---|---|
| HTTPS on the final page | 65 | 100% |
| Strict-Transport-Security (max-age one year or more) | 45 | 69.2% |
| Content-Security-Policy | 2 | 3.1% |
| Clickjacking protection | 35 | 53.8% |
| X-Content-Type-Options: nosniff | 47 | 72.3% |
| Referrer-Policy (strict value) | 25 | 38.5% |
| Permissions-Policy | 18 | 27.7% |
| No version disclosure | 55 | 84.6% |
Across the 8 counted checks, the mean number of passes per graded site is 4.5. The median is 5.
| Checks passed (of 8) | Sites |
|---|---|
| 1 | 3 |
| 2 | 7 |
| 3 | 8 |
| 4 | 11 |
| 5 | 18 |
| 6 | 10 |
| 7 | 7 |
| 8 | 1 |
HSTS#
All 65 graded responses ended on https.
| HSTS max-age | Sites |
|---|---|
| No header | 9 |
| Under 6 months | 4 |
| 6 months to under 1 year | 7 |
| 1 year or more | 45 |
| of which 2 years or more | 13 |
32 sites set includeSubDomains and 21 set preload.
Content-Security-Policy#
| CSP state | Sites |
|---|---|
| No CSP header | 23 |
| Report-Only header only | 2 |
| Enforced policy | 40 |
| Enforced policy that passes our check | 2 |
Our check flagged these weaknesses in the 40 enforced policies. A policy can have more than one.
| Weakness in an enforced policy | Policies (of 40) |
|---|---|
No object-src and no default-src 'none' |
24 |
No script-src or default-src |
20 |
unsafe-inline in script-src with no nonce or hash |
16 |
unsafe-eval allowed for scripts |
13 |
| Wildcard or scheme source in script-src | 6 |
A policy with no script-src or default-src (20 of 40) does not restrict scripts at all. 18 of those 20 contain only frame-ancestors, upgrade-insecure-requests or both. We did not test why each policy allows these sources.
Clickjacking, Referrer-Policy and Permissions-Policy#
29 sites set CSP frame-ancestors, and in 7 of them the value contains a wildcard, which the checker flags. 13 more rely on X-Frame-Options alone. 23 set neither.
34 sites send no Referrer-Policy. Modern browsers then default to strict-origin-when-cross-origin. 25 set a strict value and 6 set a value that can send full URLs to other sites. 18 sites send a Permissions-Policy.
Version disclosure, cookies and other headers#
10 of 65 responses (15.4%) carry an X-Powered-By header that names software. None has a Server header with a version number.
25 responses set at least one cookie on the homepage. 21 of those set only Cloudflare's bot and rate-limit cookies (__cf_bm or _cfuvid), which carry Secure, HttpOnly and SameSite. 4 responses have a cookie without Secure or without an explicit SameSite, and 2 have a cookie without HttpOnly. The checker reads the first 20 cookies of a response and does not know which cookie is a session cookie.
Cross-Origin-Opener-Policy: same-origin is set on 5 sites. X-XSS-Protection with a value other than 0, which OWASP now suggests dropping, appears on 19. 9 responses send an Access-Control-Allow-Origin header.
How this compares with the top 1,000 websites#
The same checker and rules graded 677 homepages from the Tranco top 1,000, also on 9 November 2026. The two groups differ in size and kind, so read the comparison as context, not as a test.
| Check | Pentest providers (65) | Tranco top 1,000 (677) |
|---|---|---|
| HSTS pass | 69.2% | 49.9% |
| No CSP header | 35.4% | 46.1% |
| CSP pass | 3.1% | 5.5% |
| nosniff | 72.3% | 54.8% |
| Referrer-Policy pass | 38.5% | 22.5% |
| Permissions-Policy | 27.7% | 21.7% |
| Version disclosure | 15.4% | 19.4% |
| Mean checks passed (of 8) | 4.5 | 3.9 |
The top 1,000 figures come from the security headers study of the top 1,000 sites. Many of those 677 are CDN or API hosts, not marketing sites.
Limitations#
- One request per provider, from one machine, at one point in time (23:09 to 23:17 UTC, 9 November 2026). Bot filters, regional answers and rate limits can change the headers a site returns.
- One page per provider. A homepage is usually a marketing site. Client portals, report platforms and testing infrastructure can set different headers, and we did not check them.
- 5 of the 66 URLs in the dataset point to a product or language page, not the bare homepage.
- One site was not graded because of a limit in our checker, and one graded response was a 403.
- Pass and fail follow our checker's rules. Another tool with other thresholds will give other numbers.
- Headers are a hardening layer. This is not a penetration test, it tests no application, and it says nothing about the quality of any provider's testing. A site with every header set can still have broken access control.
Download the data#
- results.csv: one row per provider (66 rows), with the checked URL, final URL, HTTP status, check time, the status of each check, the number of the 8 checks passed and the error for the site not graded.
- results.json: the full checker output per provider, with header values and redirect hops.
- summary.json: every figure on this page with its denominator.
The files are under the MIT licence. Cite as: PentestCompare, "Security headers of 66 penetration testing providers' own websites", 9 November 2026, https://pentestcompare.com/research/pentest-provider-security-headers/. For what providers publish about their services, see what 66 pentest providers do not publish.
Questions
Does a missing header mean a pentest provider is insecure or tests badly?
No. A header limits the damage when another bug exists, such as cross-site scripting. A marketing homepage is often run by a different team, on a different platform, from the systems a provider tests with or stores client data on. This study counts headers on one response and says nothing about the quality of anyone's testing.
Why are the providers not ranked or named?
One homepage response at one moment is too thin a basis for a ranking. The page reports counts. Each provider's row is in the raw data, so anyone can check a figure, but we do not pick winners or name the weakest results.
Why is Excession Labs not included?
Excession Labs publishes PentestCompare and runs the sites in its own row. We own those sites, so we do not grade ourselves next to the providers we compare. The study covers the 66 other providers in the dataset.
How do I check a provider's site, or my own?
Use the free security headers checker on penetrationtestservices.com. It sends one GET request per redirect and reads headers only, the same check used for this study. A provider's homepage tells you little about the systems that will hold your data, so ask about those.
Sources
- PentestCompare provider dataset (providers.json) (checked 9 November 2026)
- OWASP Secure Headers Project (checked 9 November 2026)
- MDN: Content-Security-Policy header (checked 9 November 2026)
- IANA IPv4 Special-Purpose Address Registry (checked 9 November 2026)