GoKawiilStudy: half of 4,688 small-business sites fail all seven security-header checks
A 2026 study sampled 7,040 U.S. local-business website listings from the Curlie directory, checking each for seven security headers via a single-request scan. After deduplicating to one HTTP-200 response per unique domain (4,688 sites), 49.7% met none of the seven header criteria.