This page is for a student who is about to crawl HTTP response headers — CSP, HSTS, X-Frame-Options, SRI, Trusted Types, COOP/COEP — and needs to know which of those are still a measurement, which figures the seven-venue corpus actually contains, and what a landing-page GET will miss. It is not a tutorial on what a header does. For script-level XSS instrumentation see javascript and foxhound; for scanning ethics, ethics.

The publication corpus is CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, 5,859 extracted papers. 1,622 of them measured the web platform; 1,120 ran a crawl. Every corpus-derived claim below is about those seven venues; standards and browser-source facts are dated to 2026-08-27 and named as such.

• Here: which security headers a crawl can still usefully observe in 2026, which papers measured them, and the configuration traps (landing page, login, redirect hops, third-party scripts, archive vs live) that move the number.
• Not here: how to write a CSP. How HSTS works (RFC 6797). How to exploit a missing header. Those are MDN and the specs.
• security: the namespace outline. This is the headers child; TLS/CT is TLS certificates, VirusTotal-as-oracle is VirusTotal.

Date the method. A ranking of what the literature did is not advice about what to do now. Operationally, in 2026:

Weichselbaum et al. closed host-allowlist CSP as a security mechanism in 2016 [1Weichselbaum, Lukas; Spagnuolo, Michele; Lekies, Sebastian; Janc, Artur (2016): "CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]. What is still worth measuring:

• Nonce / hash + strict-dynamic. The replacement Weichselbaum argued for. 10 of the 44 measured papers name strict-dynamic in full text; 3 name a nonce. That is a mention probe, not a “they measured nonces” count.
• Whether the policy is for XSS. Roth et al.: 58% of enforcing sites used CSP for TLS upgrade, framing control, or mixed-content, not script restriction [2Roth, Sebastian; Barron, Timothy; Calzavara, Stefano; Nikiforakis, Nick; Stock, Ben (2020): "Complex security policy? A longitudinal analysis of deployed content security policies", in: Proceedings of the 27th Network and Distributed System Security Symposium (NDSS).]. Report the use case, not the header count.
• Third-party blockage. Steffens et al. [3Steffens, Marius; Musch, Marius; Johns, Martin; Stock, Ben (2021): "Who’s Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI", in: Proceedings of the Network and Distributed System Security Symposium. (Link)]. If you do not attribute unsafe-inline to a first-party or third-party script, you will republish “CSP is unsafe” as if the operator chose it.
• Consistency across pages of one site. Calzavara et al.: 200 (46%) origins across 141 sites that had at least one safe CSP deployed it only on a subset of pages [5Calzavara, Stefano; Urban, Tobias; Tatang, Dennis; Steffens, Marius; Stock, Ben (2021): "Reining in the Web’s Inconsistencies with Site Policy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)].
• Phishing vs benign, if that is the question. Lim et al.: 5.4% of phishing sites vs 75.2% of benign sites used CSP [6Lim, Kyungchan; Lee, Kiho; Ji, Fujiao; Kwon, Yonghwi; Kim, Hyoungshick; Kim, Doowon (2025): "What's in Phishers: A Longitudinal Study of Security Configurations in Phishing Websites and Kits", in: Proceedings of the ACM Web Conference. (DOI)]. Do not mix that denominator with Tranco.

CSP Level 3 is still a W3C Working Draft (Last-Modified 13 August 2026). It deprecates report-uri in favour of report-to.¹⁾

Two different instruments, still confused in this corpus:

• The Strict-Transport-Security header you see on a response (RFC 6797). A browser honours it only when it arrived over HTTPS; a crawl can still log the bytes on an HTTP hop, and that is a different claim. Zheng et al., Alexa ~1M, 2015: 1,252 domains (0.13%) had full HSTS [7Zheng, Xiaofeng; Jiang, Jian; Liang, Jinjin; Duan, Haixin; Chen, Shuo; Wan, Tao; Weaver, Nicholas (2015): "Cookies Lack Integrity: Real-World Implications", in: Proceedings of the USENIX Security Symposium. (Link)]. Kranch and Bonneau: of 12,593 sites setting dynamic HSTS, 7,494 (59.5%) did so erroneously [8Kranch, Michael; Bonneau, Joseph (2015): "Upgrading HTTPS in Mid-Air: An Empirical Study of Strict Transport Security and Key Pinning", in: Proceedings of the Network and Distributed System Security Symposium. (Link)]. Calzavara et al. 2021: of 5,352 sites that deploy HSTS somewhere, 4,351 (81%) do so inconsistently across the site [5Calzavara, Stefano; Urban, Tobias; Tatang, Dennis; Steffens, Marius; Stock, Ben (2021): "Reining in the Web’s Inconsistencies with Site Policy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)].
• The HSTS preload list shipped in the browser binary. A crawl that never sees an HTTP hop cannot tell a preloaded name from a name that sent the header last week. Felt et al. report Observatory HSTS and preload rates as HTTPS-adoption context [9Felt, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa (2017): "Measuring HTTPS Adoption on the Web", in: Proceedings of the USENIX Security Symposium. (Link)].

Currency, 2026-08-27. hstspreload.org still takes submissions (max-age at least 31536000, includeSubDomains, preload). It also says, in the same page: “While HSTS is recommended, HSTS preloading is not recommended.” The stated reason is that Chrome and Safari already upgrade HTTP navigations to HTTPS, so preload only helps when those upgrades fail against an active attacker.²⁾ A paper that treats preload-list membership as the HSTS adoption rate in 2026 is answering a question the list's own operators no longer recommend asking.

Luo et al. crawled Alexa 50k: 175 of 231 ALLOW-FROM sites lacked frame-ancestors and were clickjackable in most mobile browsers [10Luo, Meng; Laperdrix, Pierre; Honarmand, Nima; Nikiforakis, Nick (2019): "Time Does Not Heal All Wounds: A Longitudinal Analysis of Security Mechanism Support in Mobile Browsers", in: Proceedings of the Network and Distributed System Security Symposium. (Link)]. Roth et al., December 2018: XFO still outnumbered frame-ancestors 3,253 to 409 [2Roth, Sebastian; Barron, Timothy; Calzavara, Stefano; Nikiforakis, Nick; Stock, Ben (2020): "Complex security policy? A longitudinal analysis of deployed content security policies", in: Proceedings of the 27th Network and Distributed System Security Symposium (NDSS).]. Calzavara et al. 2020 ran a formal comparison of the two headers across ten browsers and found 1,800 inconsistent policies from 1,779 origins [11Calzavara, Stefano; Roth, Sebastian; Rabitti, Alvise; Backes, Michael; Stock, Ben (2020): "A Tale of Two Headers: A Formal Analysis of Inconsistent Click-Jacking Protection on the Web", in: Proceedings of the USENIX Security Symposium. (Link)]. If you record only XFO, you miss the CSP framing control; if you record only CSP, you miss the sites that never migrated.

Chapuis et al., Common Crawl: SRI on 3.40% of pages [12Chapuis, Bertil; Omolola, Olamide; Cherubini, Mauro; Humbert, Mathias; Huguenin, Kévin (2020): "An Empirical Study of the Use of Integrity Verification Mechanisms for Web Subresources", in: Proceedings of the ACM Web Conference. (DOI)]. Kumar et al., 2017, third-party inclusions: less than 1% of sites [13Kumar, Deepak; Ma, Zane; Durumeric, Zakir; Mirian, Ariana; Mason, Joshua; Halderman, J. Alex; Bailey, Michael D. (2017): "Security Challenges in an Increasingly Tangled Web", in: Proceedings of the ACM Web Conference. (DOI)]. Soni et al. measured script churn and concluded raw SRI signatures need updates “at an impractical rate” [14Soni, Pratik; Budianto, Enrico; Saxena, Prateek (2015): "The SICILIAN Defense: Signature-based Whitelisting of Web JavaScript", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] — that is the measurement Steffens later made causal (the third party will not pin). A presence census without “who holds the integrity attribute” repeats 2015.

Trusted Types is a W3C Working Draft dated 23 June 2026, enforced via CSP's require-trusted-types-for / trusted-types.³⁾ 3 of the 44 measured papers name Trusted Types in full text; 3 name COOP; 3 name COEP. Khodayari et al. are the rare paper that reports live-web rates for these: CSP connect-src on 7.6%, COOP about 1.9%, COEP about 1% [15Khodayari, Soheil; Barber, Thomas; Pellegrino, Giancarlo (2024): "The Great Request Robbery: An Empirical Study of Client-side Request Hijacking Vulnerabilities on the Web", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]. connect-src is a CSP fetch directive, not a cross-origin-isolation header; COOP/COEP are. Do not pad a Trusted Types section with the 13 web-platform papers that merely mention the token — that 13 is a keyword hit, not a census.

Chromium's current net/http/http_security_headers.cc (fetched 2026-08-27) parses Strict-Transport-Security and does not mention Expect-CT or Public-Key-Pins. Four of the 44 measured papers still name X-XSS-Protection; one names Expect-CT; seven name HPKP. Those are historical rows, not current instruments.

Of the 39 measured papers that are also in the crawled population, crawlConfig.interactionDepth is:

11 of 39 (28.2%) are landing-page-only. That is the configuration Roth, Calzavara (Site Policy), Roth (Security Lottery) and Rautenstrauch each independently show is not a site:

• A CSP on / and not on /login is a different security posture after the user authenticates [4Rautenstrauch, Jannis; Mitkov, Metodi; Helbrecht, Thomas; Hetterich, Lorenz; Stock, Ben (2024): "To Auth or Not To Auth? A Comparative Analysis of the Pre- and Post-Login Security Landscape", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)].
• HSTS on one origin of a registrable domain is not HSTS on the site [5Calzavara, Stefano; Urban, Tobias; Tatang, Dennis; Steffens, Marius; Stock, Ben (2021): "Reining in the Web’s Inconsistencies with Site Policy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)].
• XFO on the landing page does not frame-protect a third-party widget the landing page includes [3Steffens, Marius; Musch, Marius; Johns, Martin; Stock, Ben (2021): "Who’s Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI", in: Proceedings of the Network and Distributed System Security Symposium. (Link)].
• Client UA, viewport and cookie-jar change which header the same URL returns. Roth et al. 2022 built 13,626,145 responses from the Tranco 10,000 for that reason [16Roth, Sebastian; Calzavara, Stefano; Wilhelm, Moritz; Rabitti, Alvise; Stock, Ben (2022): "The Security Lottery: Measuring Client-Side Web Security Inconsistencies", in: Proceedings of the USENIX Security Symposium, pp. 2047-2064. (Link)].
• Archives drop or rewrite headers. Hantke et al. compared live vs archived XFO/CSP/HSTS/COOP/COEP [17Hantke, Florian; Calzavara, Stefano; Wilhelm, Moritz; Rabitti, Alvise; Stock, Ben (2023): "You Call This Archaeology? Evaluating Web Archives for Reproducible Web Security Measurements", in: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 3168–3182. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)].

Headless is stated by 7 of 39 (17.9%); statefulness by 11 of 39 (28.2%). Those are reporting rates, not practice rates.

The hop trap is mechanical. urllib follows redirects by default, and many crawler clients do unless you turn that off, so a script that prints response.headers after urlopen is printing the last hop. HSTS on the HTTP apex, CSP on /app, XFO only after login — all invisible. observe_headers.py –demo is a local two-hop fixture (no network). The apex 302 sends HSTS and no CSP; /app sends CSP + X-Frame-Options and no HSTS. The fixture is HTTP on purpose, so you can see the bytes; RFC 6797 requires a browser to ignore HSTS received over insecure transport. “The header was on hop 0” is not “the browser pin-loaded HSTS”.

START http://127.0.0.1:8765/
HOPS 2
--- hop 0 status=302 url=http://127.0.0.1:8765/
    strict-transport-security: max-age=31536000; includeSubDomains
    content-security-policy: ABSENT
    content-security-policy-report-only: ABSENT
    x-frame-options: ABSENT
    cross-origin-opener-policy: ABSENT
    cross-origin-embedder-policy: ABSENT
    cross-origin-resource-policy: ABSENT
    x-content-type-options: ABSENT
    referrer-policy: ABSENT
    permissions-policy: ABSENT
    reporting-endpoints: ABSENT
    report-to: ABSENT
    expect-ct: ABSENT
    public-key-pins: ABSENT
    x-xss-protection: ABSENT
    WANTED_PRESENT 1/15
--- hop 1 status=200 url=http://127.0.0.1:8765/app
    strict-transport-security: ABSENT
    content-security-policy: default-src 'self'; frame-ancestors 'none'
    content-security-policy-report-only: ABSENT
    x-frame-options: DENY
    cross-origin-opener-policy: ABSENT
    cross-origin-embedder-policy: ABSENT
    cross-origin-resource-policy: ABSENT
    x-content-type-options: ABSENT
    referrer-policy: ABSENT
    permissions-policy: ABSENT
    reporting-endpoints: ABSENT
    report-to: ABSENT
    expect-ct: ABSENT
    public-key-pins: ABSENT
    x-xss-protection: ABSENT
    WANTED_PRESENT 2/15
DEMO_SPLIT apex_hsts='max-age=31536000; includeSubDomains' app_csp="default-src 'self'; frame-ancestors 'none'" app_xfo='DENY'

observe_headers.py

#!/usr/bin/env python3
"""Print the security headers a crawl will actually see, hop by hop.
 
urllib follows redirects by default. A landing-page GET that then looks only
at the last response will miss HSTS on an intermediate hop, a CSP that exists
only on the apex, and X-Frame-Options that exist only on /login. This script
does not follow: it prints each hop. Stdlib only.
 
    python3 observe_headers.py https://example.com/
    python3 observe_headers.py --demo
 
--demo starts a local two-hop fixture (no network): an apex that redirects
with HSTS and no CSP, then /app which ships CSP + X-Frame-Options. Exit 1 if
the hop list is empty or the fixture does not show that split.
"""
from __future__ import annotations
 
import argparse
import http.server
import ssl
import sys
import threading
import urllib.error
import urllib.request
 
UA = "measuretheweb-observe-headers/1.0 (research; +https://measuretheweb.org/security/headers)"
WANTED = (
    "strict-transport-security",
    "content-security-policy",
    "content-security-policy-report-only",
    "x-frame-options",
    "cross-origin-opener-policy",
    "cross-origin-embedder-policy",
    "cross-origin-resource-policy",
    "x-content-type-options",
    "referrer-policy",
    "permissions-policy",
    "reporting-endpoints",
    "report-to",
    "expect-ct",
    "public-key-pins",
    "x-xss-protection",
)
REDIRECT_CODES = {301, 302, 303, 307, 308}
 
 
class NoFollow(urllib.request.HTTPRedirectHandler):
    """Turn redirects into HTTPError so the caller can print that hop."""
 
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        return None
 
 
def fetch_hops(url: str, max_hops: int = 8) -> list[dict]:
    hops: list[dict] = []
    current = url
    ctx = ssl.create_default_context()
    opener = urllib.request.build_opener(
        NoFollow(),
        urllib.request.HTTPSHandler(context=ctx),
    )
    opener.addheaders = [("User-Agent", UA)]
    for i in range(max_hops):
        req = urllib.request.Request(current, method="GET")
        try:
            resp = opener.open(req, timeout=30)
        except urllib.error.HTTPError as e:
            resp = e
        except urllib.error.URLError as e:
            raise RuntimeError(f"hop {i} fetch failed for {current}: {e}") from e
        got: dict[str, str] = {}
        for k, v in resp.headers.items():
            got[k.lower()] = v
        hop = {
            "url": current,
            "status": resp.status,
            "headers": got,
        }
        hops.append(hop)
        loc = None
        if hop["status"] in REDIRECT_CODES:
            loc = got["location"]
        resp.close()
        if loc is None:
            break
        current = urllib.request.urljoin(current, loc)
    else:
        raise RuntimeError(f"more than {max_hops} redirects starting at {url}")
    return hops
 
 
def print_hops(url: str, hops: list[dict]) -> None:
    print(f"START {url}")
    print(f"HOPS {len(hops)}")
    for i, hop in enumerate(hops):
        print(f"--- hop {i} status={hop['status']} url={hop['url']}")
        present = 0
        for name in WANTED:
            if name in hop["headers"]:
                present += 1
                value = hop["headers"][name]
                if len(value) > 180:
                    value = value[:177] + "..."
                print(f"    {name}: {value}")
            else:
                print(f"    {name}: ABSENT")
        print(f"    WANTED_PRESENT {present}/{len(WANTED)}")
 
 
class FixtureHandler(http.server.BaseHTTPRequestHandler):
    """Apex redirects with HSTS; /app is where CSP and XFO live."""
 
    def log_message(self, fmt: str, *args) -> None:
        return
 
    def do_GET(self) -> None:
        if self.path == "/" or self.path == "":
            self.send_response(302)
            self.send_header("Location", "/app")
            self.send_header("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
            self.send_header("Content-Length", "0")
            self.end_headers()
            return
        if self.path == "/app":
            body = b"<html><body>app</body></html>"
            self.send_response(200)
            self.send_header("Content-Type", "text/html")
            self.send_header("Content-Length", str(len(body)))
            self.send_header("Content-Security-Policy", "default-src 'self'; frame-ancestors 'none'")
            self.send_header("X-Frame-Options", "DENY")
            self.end_headers()
            self.wfile.write(body)
            return
        self.send_error(404)
 
 
def run_demo() -> None:
    server = http.server.HTTPServer(("127.0.0.1", 8765), FixtureHandler)
    port = server.server_address[1]
    thread = threading.Thread(target=server.serve_forever, daemon=True)
    thread.start()
    url = f"http://127.0.0.1:{port}/"
    try:
        hops = fetch_hops(url)
        if len(hops) != 2:
            raise RuntimeError(f"demo expected 2 hops, got {len(hops)}")
        hsts0 = hops[0]["headers"]["strict-transport-security"]
        if "content-security-policy" in hops[0]["headers"]:
            raise RuntimeError("demo apex unexpectedly has CSP")
        csp1 = hops[1]["headers"]["content-security-policy"]
        xfo1 = hops[1]["headers"]["x-frame-options"]
        if "strict-transport-security" in hops[1]["headers"]:
            raise RuntimeError("demo /app unexpectedly has HSTS")
        print_hops(url, hops)
        print(f"DEMO_SPLIT apex_hsts={hsts0!r} app_csp={csp1!r} app_xfo={xfo1!r}")
    finally:
        server.shutdown()
        server.server_close()
 
 
def main() -> int:
    ap = argparse.ArgumentParser()
    ap.add_argument("url", nargs="?")
    ap.add_argument("--demo", action="store_true")
    args = ap.parse_args()
    if args.demo:
        run_demo()
        return 0
    if args.url is None:
        print("usage: observe_headers.py URL | --demo", file=sys.stderr)
        return 2
    hops = fetch_hops(args.url)
    if len(hops) == 0:
        raise RuntimeError(f"empty hop list for {args.url}")
    print_hops(args.url, hops)
    return 0
 
 
if __name__ == "__main__":
    raise SystemExit(main())

Chang et al. measured the same split in the wild: of 41,575 websites that set HSTS on at least one hop of a four-trail check, only 6,567 (15.8%) set it on all four [18Chang, Li; Hsiao, Hsu-Chun; Jeng, Wei; Kim, Tiffany Hyun-Jin; Lin, Wei-Hsi (2017): "Security Implications of Redirection Trail in Popular Websites Worldwide", in: Proceedings of the ACM Web Conference. (DOI)].

CSP3: report-uri is deprecated; report-to is the Reporting API directive; if both are present, report-to wins. Endpoint declaration moved from the Report-To header to Reporting-Endpoints (W3C Reporting-1, fetched 2026-08-27).

In this corpus, among the 44 measured papers, 4 name report-uri, 2 name report-to, 0 name Reporting-Endpoints. The same zero holds over all 1,622 web-platform papers. A 2026 crawl that only looks for report-uri will under-count sites that already moved; a crawl that only looks for Reporting-Endpoints has no peer in this corpus to compare against. Record all three, and say which one you used as the existence test.

Page population: the 44 papers whose role is measured. Membership is the namespace full-text probe restricted to platforms including web; the role is a hand verdict. 2025–2026 is provisional (corpus). Zero posters in the 44.

The other 132 web probe hits, so they cannot vanish: mention 72, homograph 26, defense 14, citation 13, instrument 7 (headers as a feature for tracking or bot detection, not a deployment census). Agarwal et al. are measured: they count the live-site CSP/XFO/HSTS headers that Chrome extensions inject, drop or rewrite (205 extensions strip CSP; 446 drop XFO) [19Agarwal, Shubham (2022): "Helping or Hindering?: How Browser Extensions Undermine Security", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] — the subject is the extension's effect on the site's header, not a site-adoption census. Somé et al. 2017 are measured: 5.29% of 10,000 Alexa sites had some page with CSP, and 72% of those CSPs (12,899 pages) can be potentially violated [20Somé, Dolière Francis; Bielova, Nataliia; Rezk, Tamara (2017): "On the Content Security Policy Violations due to the Same-Origin Policy", in: Proceedings of the ACM Web Conference. (DOI)].

• The header name as on the wire (Content-Security-Policy, not “a CSP”), and whether you counted Content-Security-Policy-Report-Only separately.
• Every hop, not the post-redirect response. Chang et al. [18Chang, Li; Hsiao, Hsu-Chun; Jeng, Wei; Kim, Tiffany Hyun-Jin; Lin, Wei-Hsi (2017): "Security Implications of Redirection Trail in Popular Websites Worldwide", in: Proceedings of the ACM Web Conference. (DOI)] and the demo above.
• Which page of the site: landing, inner, login. Rautenstrauch et al. [4Rautenstrauch, Jannis; Mitkov, Metodi; Helbrecht, Thomas; Hetterich, Lorenz; Stock, Ben (2024): "To Auth or Not To Auth? A Comparative Analysis of the Pre- and Post-Login Security Landscape", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)]; Calzavara et al. [5Calzavara, Stefano; Urban, Tobias; Tatang, Dennis; Steffens, Marius; Stock, Ben (2021): "Reining in the Web’s Inconsistencies with Site Policy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)].
• The use case of a CSP (XSS / framing / TLS / mixed-content), not a boolean [2Roth, Sebastian; Barron, Timothy; Calzavara, Stefano; Nikiforakis, Nick; Stock, Ben (2020): "Complex security policy? A longitudinal analysis of deployed content security policies", in: Proceedings of the 27th Network and Distributed System Security Symposium (NDSS).].
• For SRI and CSP, who introduced the unsafe token or the unpinned include [3Steffens, Marius; Musch, Marius; Johns, Martin; Stock, Ben (2021): "Who’s Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI", in: Proceedings of the Network and Distributed System Security Symposium. (Link)].
• Browser / UA / viewport if the claim is about what a user would be protected by [16Roth, Sebastian; Calzavara, Stefano; Wilhelm, Moritz; Rabitti, Alvise; Stock, Ben (2022): "The Security Lottery: Measuring Client-Side Web Security Inconsistencies", in: Proceedings of the USENIX Security Symposium, pp. 2047-2064. (Link)].
• Live vs archive, if you used one [17Hantke, Florian; Calzavara, Stefano; Wilhelm, Moritz; Rabitti, Alvise; Stock, Ben (2023): "You Call This Archaeology? Evaluating Web Archives for Reproducible Web Security Measurements", in: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 3168–3182. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)].
• The year of the crawl, because whitelist CSP, HPKP, Expect-CT and preload-as-adoption are dated methods.

Every number in the corpus tables is a count of papers, from the 5,859-paper extraction. The 176 is an upper bound the namespace page already published; this page's population is the 44 measured roles. Four corpus papers have no paper.cols.txt and cannot match. Queries, the unedited report, the 176 deciding sentences, and the homograph list: headers. Corpus-wide caveats: corpus.

[1]

Weichselbaum, Lukas; Spagnuolo, Michele; Lekies, Sebastian; Janc, Artur (2016): "CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[2]

Roth, Sebastian; Barron, Timothy; Calzavara, Stefano; Nikiforakis, Nick; Stock, Ben (2020): "Complex security policy? A longitudinal analysis of deployed content security policies", in: Proceedings of the 27th Network and Distributed System Security Symposium (NDSS).

[3]

Steffens, Marius; Musch, Marius; Johns, Martin; Stock, Ben (2021): "Who’s Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[4]

Rautenstrauch, Jannis; Mitkov, Metodi; Helbrecht, Thomas; Hetterich, Lorenz; Stock, Ben (2024): "To Auth or Not To Auth? A Comparative Analysis of the Pre- and Post-Login Security Landscape", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[5]

Calzavara, Stefano; Urban, Tobias; Tatang, Dennis; Steffens, Marius; Stock, Ben (2021): "Reining in the Web’s Inconsistencies with Site Policy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[6]

Lim, Kyungchan; Lee, Kiho; Ji, Fujiao; Kwon, Yonghwi; Kim, Hyoungshick; Kim, Doowon (2025): "What's in Phishers: A Longitudinal Study of Security Configurations in Phishing Websites and Kits", in: Proceedings of the ACM Web Conference. (DOI)

[7]

Zheng, Xiaofeng; Jiang, Jian; Liang, Jinjin; Duan, Haixin; Chen, Shuo; Wan, Tao; Weaver, Nicholas (2015): "Cookies Lack Integrity: Real-World Implications", in: Proceedings of the USENIX Security Symposium. (Link)

[8]

Kranch, Michael; Bonneau, Joseph (2015): "Upgrading HTTPS in Mid-Air: An Empirical Study of Strict Transport Security and Key Pinning", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[9]

Felt, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa (2017): "Measuring HTTPS Adoption on the Web", in: Proceedings of the USENIX Security Symposium. (Link)

[10]

Luo, Meng; Laperdrix, Pierre; Honarmand, Nima; Nikiforakis, Nick (2019): "Time Does Not Heal All Wounds: A Longitudinal Analysis of Security Mechanism Support in Mobile Browsers", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[11]

Calzavara, Stefano; Roth, Sebastian; Rabitti, Alvise; Backes, Michael; Stock, Ben (2020): "A Tale of Two Headers: A Formal Analysis of Inconsistent Click-Jacking Protection on the Web", in: Proceedings of the USENIX Security Symposium. (Link)

[12]

Chapuis, Bertil; Omolola, Olamide; Cherubini, Mauro; Humbert, Mathias; Huguenin, Kévin (2020): "An Empirical Study of the Use of Integrity Verification Mechanisms for Web Subresources", in: Proceedings of the ACM Web Conference. (DOI)

[13]

Kumar, Deepak; Ma, Zane; Durumeric, Zakir; Mirian, Ariana; Mason, Joshua; Halderman, J. Alex; Bailey, Michael D. (2017): "Security Challenges in an Increasingly Tangled Web", in: Proceedings of the ACM Web Conference. (DOI)

[14]

Soni, Pratik; Budianto, Enrico; Saxena, Prateek (2015): "The SICILIAN Defense: Signature-based Whitelisting of Web JavaScript", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[15]

Khodayari, Soheil; Barber, Thomas; Pellegrino, Giancarlo (2024): "The Great Request Robbery: An Empirical Study of Client-side Request Hijacking Vulnerabilities on the Web", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[16]

Roth, Sebastian; Calzavara, Stefano; Wilhelm, Moritz; Rabitti, Alvise; Stock, Ben (2022): "The Security Lottery: Measuring Client-Side Web Security Inconsistencies", in: Proceedings of the USENIX Security Symposium, pp. 2047-2064. (Link)

[17]

Hantke, Florian; Calzavara, Stefano; Wilhelm, Moritz; Rabitti, Alvise; Stock, Ben (2023): "You Call This Archaeology? Evaluating Web Archives for Reproducible Web Security Measurements", in: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 3168–3182. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[18]

Chang, Li; Hsiao, Hsu-Chun; Jeng, Wei; Kim, Tiffany Hyun-Jin; Lin, Wei-Hsi (2017): "Security Implications of Redirection Trail in Popular Websites Worldwide", in: Proceedings of the ACM Web Conference. (DOI)

[19]

Agarwal, Shubham (2022): "Helping or Hindering?: How Browser Extensions Undermine Security", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[20]

Somé, Dolière Francis; Bielova, Nataliia; Rezk, Tamara (2017): "On the Content Security Policy Violations due to the Same-Origin Policy", in: Proceedings of the ACM Web Conference. (DOI)