{
  "study": "Bezpečnostní HTTP hlavičky napříč obory v ČR",
  "publisher": "CIAD - Český institut pro AI a data",
  "url": "https://ciad.cz/studie/bezpecnostni-hlavicky-napric-obory/",
  "license": "CC BY 4.0",
  "generated": "2026-08-03",
  "scan_dates": {
    "fresh_headers_and_tls": "2026-08-03",
    "archive_corpus": "no single date; median age five to eight weeks before 2026-08-03"
  },
  "note_on_data": "Agregátní data bez doménových jmen a bez jmen firem. Vzorek je konvenienční (výzkumný korpus CIAD napříč obory), ne náhodný vzorek českých firem. Tři samostatné zdroje s různými denominátory - viz per-metric n níže; nekombinovat čísla mezi zdroji.",
  "sample": {
    "fresh_headers_scan": {
      "targeted": 299,
      "reachable": 266,
      "method": "isolated Chromium context, no consent-banner interaction, network-idle wait, homepage only"
    },
    "fresh_tls_version_scan": {
      "targeted": 299,
      "reachable_for_headers_and_version": 260,
      "reachable_for_tls_handshake": 257,
      "method": "GET /robots.txt (CIAD-research/1.0) plus openssl s_client TLS handshake"
    },
    "archive_corpus": {
      "canonical_subjects": 233,
      "server_banner_readable_subset": 231,
      "date": "no fixed per-subject timestamp; median age five to eight weeks before 2026-08-03",
      "used_for": "software name-disclosure metric only (lacks a Permissions-Policy field)"
    }
  },
  "scoring": {
    "definition": "same six security headers as the CIAD law-firm study: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Range 0-6, one point per present header. HTTPS and HTTP->HTTPS redirect reported separately, never blended into the score.",
    "source": "fresh_headers_scan only (n=266); archive corpus excluded from the score because it does not measure Permissions-Policy",
    "n": 266,
    "mean": 1.7,
    "median": 1.0,
    "score_0_or_1_count": 156,
    "score_0_or_1_pct": 58.6,
    "score_5_or_6_count": 40,
    "score_5_or_6_pct": 15.0,
    "distribution": {
      "0": {
        "count": 109,
        "pct": 41.0
      },
      "1": {
        "count": 47,
        "pct": 17.7
      },
      "2": {
        "count": 37,
        "pct": 13.9
      },
      "3": {
        "count": 20,
        "pct": 7.5
      },
      "4": {
        "count": 13,
        "pct": 4.9
      },
      "5": {
        "count": 21,
        "pct": 7.9
      },
      "6": {
        "count": 19,
        "pct": 7.1
      }
    }
  },
  "headers_present_n266": {
    "Strict-Transport-Security": {
      "present": 104,
      "missing": 162,
      "present_pct": 39.1
    },
    "Content-Security-Policy": {
      "present": 70,
      "missing": 196,
      "present_pct": 26.3
    },
    "X-Frame-Options": {
      "present": 97,
      "missing": 169,
      "present_pct": 36.5
    },
    "X-Content-Type-Options": {
      "present": 91,
      "missing": 175,
      "present_pct": 34.2
    },
    "Referrer-Policy": {
      "present": 55,
      "missing": 211,
      "present_pct": 20.7
    },
    "Permissions-Policy": {
      "present": 35,
      "missing": 231,
      "present_pct": 13.2
    }
  },
  "archive_cross_check_n224": {
    "note": "archive corpus, same 5 headers where both sources overlap (no Permissions-Policy field in archive); shown for corroboration only, not used in the primary score",
    "Strict-Transport-Security": {
      "present": 88,
      "measured_n": 224,
      "present_pct": 39.3
    },
    "Content-Security-Policy": {
      "present": 58,
      "measured_n": 224,
      "present_pct": 25.9
    },
    "X-Frame-Options": {
      "present": 75,
      "measured_n": 224,
      "present_pct": 33.5
    },
    "X-Content-Type-Options": {
      "present": 78,
      "measured_n": 224,
      "present_pct": 34.8
    },
    "Referrer-Policy": {
      "present": 47,
      "measured_n": 224,
      "present_pct": 21.0
    }
  },
  "independence_test": {
    "method": "compares the observed score distribution (n=266) to the distribution predicted by treating each header's adoption as an independent Bernoulli event at its own measured population rate",
    "caveat": "aggregate-level test using marginal prevalence rates, not raw per-domain joint data; not a pairwise correlation between specific header pairs",
    "score_0": {
      "observed_count": 109,
      "observed_pct": 41.0,
      "expected_count_under_independence": 34.4,
      "expected_pct_under_independence": 12.9
    },
    "score_6": {
      "observed_count": 19,
      "observed_pct": 7.1,
      "expected_count_under_independence": 0.09,
      "expected_pct_under_independence": 0.03
    },
    "variance_point_squared": {
      "observed": 3.85,
      "expected_under_independence": 1.17
    }
  },
  "https_and_redirect_n266": {
    "https_present": {
      "count": 252,
      "pct": 94.7
    },
    "http_does_not_redirect_to_https": {
      "count": 13,
      "pct": 4.9
    },
    "note": "single live measurement, no before/after wave comparison in this study"
  },
  "software_disclosure": {
    "name_disclosure_archive": {
      "source": "archive corpus",
      "n": 231,
      "count": 124,
      "pct": 53.7,
      "definition": "any identifiable software or framework name in the Server response header banner, with or without a version number",
      "category_breakdown_n124_categories_ge10_only": {
        "Apache": 31,
        "nginx": 25,
        "other_named_or_agency_signature": 19,
        "cdn_waf": 13,
        "iis_aspnet_dotnet": 11,
        "php_only": 10,
        "other_lt10_each_merged": 15
      }
    },
    "version_number_disclosure_fresh": {
      "source": "fresh TLS/version scan, 2026-08-03",
      "n": 260,
      "count": 30,
      "pct": 11.5,
      "definition": "explicit version number string in the Server response header, not just a generic name"
    },
    "note": "two distinct metrics from two different samples and dates; do not sum or directly compare as before/after"
  },
  "scan_method": {
    "headers_scan": {
      "type": "passive",
      "description": "isolated Chromium context, no cookie-consent interaction, network-idle wait, homepage only, response headers read",
      "date": "2026-08-03"
    },
    "tls_version_scan": {
      "type": "passive",
      "description": "one GET to /robots.txt plus one TLS handshake via openssl s_client (ALPN h2/http1.1, hostname verification). No other paths fetched, no authentication, no vulnerability testing.",
      "user_agent": "CIAD-research/1.0",
      "date": "2026-08-03"
    }
  }
}