Security and transport headers served by 16 web hosts on their own homepage (2026-10-31)

Security and transport headers served by 16 web hosting providers on their own public homepage, measured once on 2026-10-31 18:22 UTC from one server in Germany (datacenter IP). Method: curl -sL with a Chrome User-Agent (HSTS, CSP, HTTP/3 via alt-svc), dig AAAA (IPv6), openssl s_client -tls1_3 (TLS 1.3 handshake). Results, 11 measurable hosts: HSTS 8/11, CSP 7/11, HTTP/3 5/11, IPv6 6/11, TLS 1.3 10/11. ionos.fr refused the TLS 1.3 handshake; o2switch.fr met none of HSTS, CSP, HTTP/3, IPv6. Limits: marketing homepage only, not the rented servers. Five hosts answered HTTP 403 (LWS, Contabo, HostPapa, Bluehost, Scaleway) and are reported as not measured for header columns, never as negative. Single run, single vantage point. Published by HostPilote, a web hosting comparison site.