On 2026-10-10 I requested the homepage of the first 1,500 domains in the Tranco list (one GET each, nothing else probed) and parsed the 835 that returned HTML. No per-site results kept or named.

  • 36% had no og:image; only 20.5% declared og:image width/height
  • 43% had no apple-touch-icon; 69% no web app manifest
  • 67% sent HSTS, 52% nosniff, 29% Referrer-Policy, 15% Permissions-Policy, 47% an enforced CSP (7% Report-Only)

Big-site homepages are not typical small sites; read these as a floor.

Fixes for each, with copy-paste config: https://dimonch-byte.github.io/web-fix-notes/

Free checkers (MIT, stdlib Python): og-lint-action, favicon-audit, headers-baseline on github.com/dimonch-byte.

Disclosure: I build paid fix packs for some of these (SharePack for share cards). The data and checkers are free and work without them.