The 10 Checks Websites Fail Most, From 142 Real Audits

Between May 4 and July 19, 2026, we ran every completed audit in our production data through a simple question: which checks do websites fail most often? The answer surprised us, and we built the engine.

The top of the ranking is not canonicalization, not JavaScript rendering, not Core Web Vitals. It is HTTP response headers — single lines of configuration that most platforms never set by default. 5 of the 7 most-failed checks are security headers, and the most-failed check of all, Permissions-Policy, is missing on 82% of audited sites.

The ranking

Methodology: latest completed audit snapshot per domain, May 4 – July 19, 2026, anonymized. The sample is self-selected — owners who ran an audit — and skews toward small and mid-size sites, which likely understates header adoption (large platforms set these at the edge). Treat the ranking as directional for the long tail of the web.

Why headers fail more than everything else

Headers fail at scale because they are invisible. Nothing renders differently when they are missing. No CMS warns you. They sit below the application layer — most site owners have never edited a server config, and the platforms hosting them (shared hosting, site builders, managed WordPress) rarely set security headers on their behalf.

That invisibility makes them the purest measure of whether anyone has ever deliberately hardened a site. And it cuts both ways: because the failure is configuration rather than engineering, the fix is measured in minutes.

What the top 5 actually do

Permissions-Policy (82% missing) decides which browser features your pages may use — camera, microphone, geolocation, fullscreen, and 30+ others. Without it, every feature is available to every script on your page, including third-party tags you did not write. A sane default denies what you do not use:

Permissions-Policy: camera=(), microphone=(), geolocation=()

Referrer-Policy (70% missing) controls how much of your URL leaks to third parties when users click links or load resources. Your URLs contain campaign parameters, search queries, and sometimes tokens. This header decides who sees them:

Referrer-Policy: strict-origin-when-cross-origin

Content-Security-Policy (70% missing) is the highest-effort header on the list and the highest-value: it limits where scripts, styles, and frames may load from, which is what contains an XSS or a compromised tag manager. Start in report-only mode, watch what breaks, then enforce:

Content-Security-Policy-Report-Only: default-src 'self'

Organization schema (63% missing) is the only non-header in the top 5 — the JSON-LD block that tells search engines and AI systems who you are as an entity: name, logo, profiles, contact points. It is the foundation of knowledge-panel eligibility and of how AI search understands your brand. We covered the broader pattern in what 285 audits revealed about structured data — presence is not the problem, precision is.

X-Frame-Options (62% missing) declares whether your pages may be framed by other sites. Without it, your site can be embedded inside an attacker's page — the classic clickjacking setup, where a transparent overlay captures clicks meant for you:

X-Frame-Options: DENY

The SEO case for security headers

These are not SEO ranking checks in the direct sense — nobody gains positions by adding a header. They matter to search performance through trust and eligibility. Browsers surface security state to users, safe-browsing systems flag compromised sites, and a site that gets clickjacked or injected with a malicious frame loses its search presence the hard way. Headers are also part of how an audit — ours included — distinguishes a maintained site from an abandoned one. AI agents evaluating sources for answers apply the same distinction: the configuration layer is the visible evidence of operational discipline. The 1 content check in the top 10 works the same way — we broke down how 76% of llms.txt files fail agents in a separate report.

The fix order

Take the ranking as a checklist, top down, because that is the effort-to-impact order. Permissions-Policy, Referrer-Policy, X-Frame-Options, and X-Content-Type-Options are 4 lines you can add at your server, CDN, or platform edge today. CSP deserves an afternoon: report-only first, then enforce. Organization schema is a template change. Every audit we run checks all of these and shows the exact headers your responses sent; the free report lists each missing one with the line that fixes it.

The deeper lesson of the ranking is where risk actually accumulates. Teams budget sprints for rendering pipelines and performance budgets while the most-failed items on the average site are 4 lines of configuration. The sites that pass these checks are not better funded. They are the sites where someone, once, looked.