Security of 276 Indie App Websites (October 2026): How Many Use HSTS, CSP and Email Authentication

Key findings

The items with the widest gaps. Percentages use the sites that answered over HTTPS as the denominator (custom-domain sites for email authentication and CAA).

• Sites with a secret API key in public JS: 0 of 276. We checked the top page and the JS it loads.
• Sites that connected with TLS 1.3: 99%. 2 had a certificate expiring within 14 days.
• Sites that redirected http to https: 85%. Only 47% also set HSTS.
• Sites with a CSP: 15%, the lowest of all the headers we checked.
• Custom domains with SPF: 54%. Only 15% enforced DMARC with quarantine or reject.
• The median overall score was 60 out of 100, and the most common grade was D (37%).

Distribution of overall grades

Scored out of 100 from the severity of failed and warning items, using the same rules as the IDEAVALU free security check, then grouped from A to F.

Browser security headers

These are set with response headers. Each takes only a few lines, yet more than half of the sites lacked many of them.

Hosts such as Vercel, Netlify and Cloudflare Pages provide certificates and the https redirect automatically, but most security headers are left for you to set.

Email spoofing protection and certificate issuers

Counted over the 216 sites on custom domains, excluding hosting provider subdomains. Even a domain that sends no email can set SPF and DMARC so receivers reject mail that impersonates it.

Secret API keys and database usage

We found no site with OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase service_role or other secret keys in public JS. Note that we checked only the top page and the JS it loads first (up to 10 files per site), not JS loaded only after sign-in.

Public JS showed 26 sites using Supabase and 7 using Firebase. In these setups the browser reaches the database directly, so RLS or security rules must stop anyone reading other users' data. That cannot be checked from outside, so it is not part of this survey.

Where the sites are hosted

78% used a custom domain; the rest were on hosting provider subdomains.

Method

From the 411 products public on IDEAVALU as of October 29, 2026, we removed URLs that are not the maker's own site (App Store, Google Play, social media, marketplaces) and merged duplicate hosts, leaving 282 sites. We report on the 276 of them that answered over HTTPS.

The check is the same passive scan as the IDEAVALU free security check. We looked only at public information a browser sees when it opens the top page, plus public DNS records, with no port scans or exploit attempts, and at most four concurrent connections. We do not publish individual site names or results.

Because the survey covers only externally visible settings, passing many items does not mean a site is safe. We also did not separate out settings left off on purpose, for example on sites meant to be embedded elsewhere.

Check your own site

The IDEAVALU free security check covers the same items; just enter a URL. How to fix each one is in the guides.

• Start by adding HSTS, clickjacking protection, nosniff and the other headers in one go (see the security headers guide for config).
• On a custom domain, set up SPF and DMARC. For a domain that sends no email, v=spf1 -all and p=reject are enough.
• If you use Supabase or Firebase, review your RLS or security rules.

FAQ

Which setting did indie sites most often lack?

CSP (allowed script sources): only 15% set one. Permissions-Policy (23%) and clickjacking protection (34%) were next.

Did any site leak a secret API key?

Within the top page and the JS it loads first, 0 of 276 sites. We did not check JS used only after sign-in, so also search your own build output.

Can I cite this data?

Yes. Please credit "IDEAVALU security survey of indie apps (October 2026)" and link to this page.