What 470 GTA Business Websites Say About Web Security in 2026

We have now measured the same 500 Greater Toronto Area business domains three times in six days. The first scan asked whether they could stop someone spoofing their email. The second asked what mail platform they run. This one asks a different question: what does their website tell an attacker before anyone types anything into it?

On 6 August 2026 we made one ordinary request to the public homepage of every domain in that sample — the same request any browser or crawler makes — and read what came back. 470 of the 500 had a reachable website. We recorded whether plain http traffic is forced to https, which security response headers the server sets, whether the software discloses its own version, and who issued the TLS certificate. Nothing was probed, no login page was touched, and no domain is named.

The headline: 45.5% of GTA business websites — 214 of 470 — send none of the five basic browser security headers. Not one. Another 76 send exactly one. Nineteen sites out of 470, four percent, send all five. Throughout this study the five are HSTS, Content-Security-Policy, clickjacking protection, X-Content-Type-Options and Referrer-Policy; Permissions-Policy is reported separately because it is newer and far less widely recommended.

The Five Numbers

94.0% of the sample has a working website — 470 of 500. Having a website is essentially universal now; that is the baseline everything below sits on.

18.3% do not force HTTPS — 86 sites where typing the plain http address does not redirect you to the secure one. A further three did not answer on plain http at all and are counted in neither direction.

45.5% send zero security headers. 4.0% send all five.

82.7% of WordPress sites publish their exact WordPress version in the page source — 172 of the 208 WordPress sites in the sample.

85.5% of certificates are free and automated — Let's Encrypt (282) or Google Trust Services (120). Exactly one certificate in the whole sample expires within the next fourteen days.

What Is Actually Set, and What Is Not

Read that column downward and you can see where the market stopped. HTTPS itself is solved — the certificate problem that consumed small-business IT for a decade is genuinely over, and the free-certificate numbers above are why. Everything that came after HTTPS is not solved. Fewer than a quarter of GTA business websites defend against clickjacking, which is a decade-old attack with a one-line fix.

HSTS deserves a note, because the raw 41.5% flatters it. HSTS is the header that tells a browser to refuse plain http for your domain in future. Of the 195 sites that set it, 145 use a max-age of at least a year, which is the point at which it does real work. Only 68 extend it to subdomains and 44 request preloading. So the honest figure for "HSTS configured the way the standard intends" is closer to one site in seven than two in five.

The Finding: Your CMS Predicts This Better Than Anything Else

WordPress runs 44.3% of the business websites in this sample — 208 of 470, more than every other named platform combined. It is the default for small business on this side of the Atlantic and the data below is not an argument against using it. It is an argument about how it is usually left.

A WordPress site in this sample is nearly twice as likely to send no security headers at all, and roughly one third as likely to set HSTS. That gap is larger than any difference we found by industry, by city, or by mail platform.

Then there is the version disclosure. 172 of the 208 WordPress sites — 82.7% — publish their exact WordPress version number in a meta tag in the page source. That is the default behaviour; nobody chose it. It is also the single easiest piece of reconnaissance available on the public internet: an attacker with a list of version numbers and a list of published vulnerabilities does not need to probe anything to build a target list.

We want to be careful here, because this is the point where security writing usually overreaches. A published version number is not a vulnerability. A site running the current version and advertising it is fine. What the number does is remove the work from an attacker's side of the equation, and it tells anyone looking whether you are current — which, if you are not, is exactly what you would rather they had to find out the hard way.

The Negative Result: Email Security Barely Predicts Web Security

This is the cross-tab we expected to be the story, and it is not. Because this is the same sample we measured for SPF and DMARC on 1 August, we can ask directly whether the businesses that got email authentication right also got their website right.

The enforcing group is better on every measure, and by a margin too small to be useful. A business that has done the harder, more obscure job of getting DMARC to p=reject is still, on this data, more likely than not to be running a website with no security headers on it.

The mail-platform cut says the same thing more clearly. In our 5 August study, the platform a business ran predicted its email posture sharply — Microsoft 365 domains enforced DMARC at 27.2% against 10.8% for Google Workspace. Run the same split against web security and the difference nearly vanishes: Microsoft 365 sites set HSTS at 41.0% and Google Workspace sites at 46.5%, with Content-Security-Policy at 24.8% and 20.2% respectively. The strong signal from the email study simply does not carry over.

We think the reason is mundane and worth saying plainly: the website and the email are usually not run by the same people. The mail platform reflects whoever administers the company's IT. The website reflects whoever built it, often a marketing agency or a web designer, frequently years ago, and generally with nobody holding the job of revisiting it since. That is a hypothesis this study is consistent with rather than something it establishes — but if you are trying to work out why an organisation that clearly takes security seriously has a website that does not, that is the first place we would look.

Certificates Are a Solved Problem. Say So.

One clean piece of good news, and it deserves stating because security writing is relentlessly negative. 85.5% of the certificates in this sample are free and automatically renewed — 282 from Let's Encrypt and 120 from Google Trust Services. Sixty-four sites use a commercial certificate. Exactly one certificate in 470 expires within the next two weeks.

Ten years ago the expired-certificate outage was a routine small-business emergency. It has been engineered out of existence by automation, and there is no longer any reason for a business of any size to pay for a basic certificate or to be caught by an expiry. If you are still buying one, the only questions worth asking are whether you need organisation validation for a compliance reason and whether your renewal is automatic. If the answer to the second is no, that is the finding.

What Discloses Itself

26.0% of sites send an X-Powered-By header, which exists for no purpose other than announcing the software stack. 12.1% send a Server header carrying a version number.

Combine those with the CMS generator tag and roughly two in five GTA business websites volunteer enough about their own software for an attacker to skip reconnaissance entirely. Each of these is a configuration line, not a project. None of them requires buying anything.

What To Do About It

The honest ordering matters here, because the list above is long enough to be ignored.

First, force HTTPS. If plain http does not redirect, everything else is decoration. This affects 86 sites in our sample and it is usually a single setting at the host or CDN.

Second, turn off the announcements. Remove X-Powered-By, suppress the server version, and if you are on WordPress, remove the generator meta tag. Three configuration changes, no cost, no risk of breaking a page.

Third, add the two headers that cannot break anything. X-Content-Type-Options set to nosniff, and a clickjacking protection — either X-Frame-Options or a frame-ancestors directive. Between them they close two entire attack classes and neither has meaningful compatibility risk. Two thirds and three quarters of this sample respectively are missing them.

Fourth, HSTS, properly. Set it with a max-age of at least a year once you are confident every subdomain is on HTTPS. Do this one in that order, because turning it on before you are ready is the one item on this list that can genuinely take a site down.

Content-Security-Policy last, and deliberately. It is the most valuable header on the list and the only one that takes real work, because a policy written carelessly breaks legitimate scripts. Do not let it block the four items above it, which are free.

If you would rather see where you sit across the wider picture rather than just the web layer, our IT risk calculator scores fourteen control areas in about five minutes and runs entirely in your browser, and our free email spoof check reads the DNS side in about ten seconds.

Method, and What This Study Cannot Tell You

Sample. The same random sample of 500 GTA business domains drawn on 1 August 2026 with a fixed seed, so this study cross-tabulates exactly against our email authentication study and our mail platform study. 470 had a reachable website on 6 August 2026. The sample skews toward York Region and Vaughan and toward businesses with a web presence; it is not a probability sample of all GTA businesses.

What we requested. One HTTP request to the public homepage per domain, plus one TLS handshake on port 443. Where the bare domain did not respond we retried once at the www subdomain. We did not request login pages, administrative paths or any non-public resource, we ran no vulnerability tests, and we did not attempt to authenticate to anything.

Headers are a floor, not a ceiling. A missing security header is not a vulnerability and their presence is not proof a site is secure. A site behind a CDN or web application firewall may be protected in ways that do not appear in its response headers, and a site with all five headers can still be running unpatched software. What this measures is the visible, free, universally-recommended baseline — which is precisely why the 45.5% figure is worth publishing.

Version disclosure is disclosure, not compromise. The generator meta tag reports what the software says about itself. A site advertising a current version is in good shape. We did not check whether any version was current, and we are not going to.

TLS protocol versions are deliberately absent from this study. Our measurement client links a TLS library that cannot negotiate TLS 1.3, so every handshake in the run reported TLS 1.2 regardless of what the server actually supports. That is an artifact of our tooling, not a property of these websites, and publishing it would have been wrong. We would rather leave the row out than print a number we know is measuring ourselves.

CMS detection is conservative. We classified from the generator meta tag and from unambiguous path markers. 44.9% of sites returned no CMS signal at all — that group includes custom builds, static sites and platforms that do not identify themselves, and we have left it as an honest residual rather than distributing it.

Small groups. Any group below roughly fifteen sites is directional only. The web-host/cPanel mail group in the platform cross-tab has fifteen and should be read that way.

No domain is named. All results are aggregate. We are not publishing which businesses are exposed and we will not provide the list.

This is the third measurement in a series, and the first to look above the DNS layer. We intend to re-run it on the same sample so these become a time series rather than a snapshot. Journalists, researchers and other providers are welcome to cite these figures with attribution to IT Rapid Support.

Where IT Rapid Support Fits

We run these measurements because this is our market. IT Rapid Support is a managed IT and cybersecurity provider working from 7810 Keele Street in Vaughan. We are not a web agency and we do not build websites — which is part of why this gap interests us, because in most of the environments we take over, nobody owns the website's security posture at all.

What we do own is the rest of it: managed cybersecurity with multi-factor authentication, endpoint protection, monitored backups and around-the-clock detection and response, and Microsoft 365 managed services including the SPF, DKIM and DMARC work the first two studies in this series measured.

If you want to know where your own organisation sits against these numbers, start with the IT risk calculator or call (289) 582-9930. If it turns out your baseline is already in good shape, we will tell you that.