HTTP security headers on French public administration websites (August 2026)

A reproducible snapshot of six widely recommended HTTP security response headers across a systematic sample of 500 websites declared by French public administrations, captured on 2026-08-14. Source of the URL list: Service-public.fr - Annuaire de l'administration, published by the DILA (services of the French Prime Minister) under Licence Ouverte (fr-lo). Third-party platform URLs (social networks, shared blogging hosts) were removed so that the measurement describes the public service and not the platform. Headers measured: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy. The scanning script is included so the measurement can be reproduced or extended. Measured and published by WeThePurple.