Industry benchmark · News & media
News & media website security benchmarks — how publishers score
News and media sites face the hardest CSP problem in the industry. Ad networks, header bidders, comment systems, social embeds, video players, paywall vendors, and recirculation widgets all expect to inject script into the page. Publishers have largely accepted that a tight CSP would crater ad revenue and skipped the header altogether. TLS is universally modern — the gap is browser-side controls.
Typical news & media score range
55–78/ 100
Approximate range based on common findings in this sector. For live data, scan any of the representative sites listed below.
What they tend to get right
TLS protocols and certificates are universally up-to-date thanks to CDN defaults (Cloudflare, Fastly, Akamai). Email-auth records are mature because newsletter products depend on inbox deliverability. Cookies on subscriber-portal subdomains are typically protected.
Where they fall short
CSP is the lowest-scoring category sector-wide. X-Frame-Options is often skipped to support widget embedding. Permissions-Policy is rare. Many publishers ship server banners that disclose their CMS (WordPress, Drupal, custom) which narrows exploit research. Mixed-content warnings on legacy article pages are not uncommon.
Common findings in this sector
Findings that show up frequently across news & media sites we’ve scanned, ranked by approximate prevalence.
- ~85% of sites
Ad-tech requirements make tight CSP commercially impractical
- ~50% of sites
Widget-embeddable content often skips framing controls
- ~40% of sites
WordPress and Drupal headers commonly leak
- ~55% of sites
CMS-platform banners stay visible by default
- ~25% of sites
Newsletter senders often stay at p=none indefinitely
Scan a representative news & media site
Click any host below to run a free scan and see how it actually scores today.
Where does your site fall?
Run a free scan to see how your site compares to others in the news & media sector. The full 0–100 hardening score takes ~10 seconds.