---
title: "Website Health Report Q3 2026: security header, TLS and mobile speed statistics"
description: "Original data from 236 monitored websites: 3.5% set all six security headers, 91.9% fail the 2.5s mobile LCP threshold, median mobile LCP is 7.2 seconds. Free to cite."
canonical: "https://lemwatch.com/research/website-health-report"
source: "https://lemwatch.com"
---

# Website Health Report Q3 2026

> Frozen aggregate observations from 16 June 2026 – 14 September 2026; this is not a live fleet report.

## Security headers

 Every site was measured on the six response headers a browser actually acts on. Adoption is far lower than the security industry's guidance implies.

 Only 3.5% of websites set all six standard security headers. Sample: 226 sites, latest check each.

 57.1% of websites send a Content-Security-Policy header. Sample: 226 sites.

 30.1% of websites send HTTP Strict-Transport-Security. Sample: 226 sites.

 Only 8.8% of websites set a Permissions-Policy header. Sample: 226 sites.

 15.5% set X-Frame-Options, 34.1% set Referrer-Policy and 36.3% set X-Content-Type-Options. Sample: 226 sites.

 Just 2.7% of websites earn an A grade on their security headers overall. Sample: 226 sites.

## TLS certificates

 Certificate configuration is in much better shape than headers — automated renewal has clearly worked — but the tail is still real.

 65.8% of websites score an A or A+ on their TLS configuration. Sample: 236 sites.

 The median TLS configuration score is 95 out of 100. Sample: 236 sites.

## Domain expiry

 A lapsed domain takes a site down more completely than any server fault, and unlike a certificate it is rarely renewed automatically.

 3.3% of domains are within 30 days of expiry at any given moment. Sample: 235 domains, latest lookup each.

## Mobile performance

 Measured with Lighthouse against the mobile profile, which is the profile Google ranks on. These are the hardest numbers in the report to look at.

 The median mobile performance score is 59 out of 100; on desktop it is 76. Sample: 1,496 Lighthouse runs.

 91.9% of websites exceed the 2.5 second Largest Contentful Paint threshold on mobile. Sample: 658 mobile runs.

 The median mobile Largest Contentful Paint is 7.2 seconds — nearly three times the threshold. Sample: 658 mobile runs.

 17.2% of websites have a Cumulative Layout Shift above 0.1 on mobile. Sample: 1,496 Lighthouse runs.



## Lemwatch at a glance

- What it is: website monitoring that checks uptime, page changes, SEO, security, SSL and speed in one tool.
- Free plan: 10 sites, no time limit, all check types.
- Pro: $19/mo, 50 sites, public API and webhooks.
- Agency: $59/mo, 150 sites, white-label status pages.
- Source: https://lemwatch.com/pricing (facts verified from the product's own plan limits).



## Related

- [Website monitoring](https://lemwatch.com/features/seo-monitoring)
- [Diagnostic tools](https://lemwatch.com/tools)
- [Lemwatch pricing](https://lemwatch.com/pricing)