Rank#1
loc.gov
Tranco rank #623
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Public-sector scan snapshot · September 4, 2026
Top 100 .gov Website Security Header Ranking
Vigilai scanned the highest-ranked scannable .gov domains from Tranco’s public top-sites list and ranked them by the same public security-header checks used by the free scanner.
A
81
Grade A
B
19
Grade B
C
0
Grade C
D
0
Grade D
F
0
Grade F
RankDomainGradeIssuesTop failing headerActions
Rank#2
whitehouse.gov
Tranco rank #1,012
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#3
ed.gov
Tranco rank #2,067
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#4
sec.gov
Tranco rank #2,070
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#5
census.gov
Tranco rank #2,169
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#6
justice.gov
Tranco rank #2,192
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#7
ny.gov
Tranco rank #2,423
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#8
medlineplus.gov
Tranco rank #2,708
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#9
fbi.gov
Tranco rank #3,073
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#10
federalregister.gov
Tranco rank #3,258
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#11
osha.gov
Tranco rank #3,607
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#12
govinfo.gov
Tranco rank #5,008
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#13
ecfr.gov
Tranco rank #5,285
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#14
gao.gov
Tranco rank #5,299
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#15
gpo.gov
Tranco rank #6,217
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#16
consumerfinance.gov
Tranco rank #6,559
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#17
alaska.gov
Tranco rank #7,344
AExcellent
0
0 warnings · 8 passed
No failing headers
No failed or warning checks in this snapshot.
Rank#18
nist.gov
Tranco rank #227
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#19
epa.gov
Tranco rank #919
AExcellent
0
1 warnings · 7 passed
HTTP→HTTPS Redirect
Could not check HTTP redirect — port 80 may be blocked or the server is unavailable.
Rank#20
state.gov
Tranco rank #932
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#21
house.gov
Tranco rank #2,209
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#22
weather.gov
Tranco rank #2,322
AExcellent
0
1 warnings · 7 passed
X-Frame-Options
X-Frame-Options is missing. The page can be embedded in iframes, enabling clickjacking.
Rank#23
energy.gov
Tranco rank #2,362
AExcellent
0
1 warnings · 7 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#24
uspto.gov
Tranco rank #3,070
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#25
uscourts.gov
Tranco rank #3,837
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#26
cia.gov
Tranco rank #3,839
AExcellent
0
1 warnings · 7 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#27
uscis.gov
Tranco rank #3,868
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#28
fema.gov
Tranco rank #3,908
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#29
mo.gov
Tranco rank #4,692
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#30
pa.gov
Tranco rank #4,714
AExcellent
0
1 warnings · 7 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#31
ct.gov
Tranco rank #4,759
AExcellent
0
1 warnings · 7 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#32
cbp.gov
Tranco rank #5,093
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#33
oregon.gov
Tranco rank #6,118
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#34
fws.gov
Tranco rank #6,727
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#35
iowa.gov
Tranco rank #6,906
AExcellent
0
1 warnings · 7 passed
Referrer Policy
Referrer-Policy is not set. Full URLs may be leaked to third-party sites via the Referer header.
Rank#36
usaid.gov
Tranco rank #7,888
AExcellent
0
1 warnings · 7 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#37
doe.gov
Tranco rank #9,073
AExcellent
0
1 warnings · 7 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#38
nih.gov
Tranco rank #135
AExcellent
0
2 warnings · 6 passed
HTTP→HTTPS Redirect
Could not check HTTP redirect — port 80 may be blocked or the server is unavailable.
Rank#39
noaa.gov
Tranco rank #546
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#40
ca.gov
Tranco rank #591
AExcellent
0
2 warnings · 6 passed
X-Frame-Options
X-Frame-Options is missing. The page can be embedded in iframes, enabling clickjacking.
Rank#41
irs.gov
Tranco rank #1,356
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#42
ftc.gov
Tranco rank #1,748
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#43
bls.gov
Tranco rank #2,132
AExcellent
0
2 warnings · 6 passed
X-Content-Type-Options
X-Content-Type-Options is missing. Browsers may misinterpret file types, enabling MIME attacks.
Rank#44
dhs.gov
Tranco rank #2,608
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#45
archives.gov
Tranco rank #2,735
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#46
wa.gov
Tranco rank #2,821
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#47
dol.gov
Tranco rank #3,126
AExcellent
0
2 warnings · 6 passed
HTTP→HTTPS Redirect
HTTP returned status 301. Redirect behaviour is ambiguous.
Rank#48
cancer.gov
Tranco rank #3,139
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#49
nyc.gov
Tranco rank #3,167
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#50
cisa.gov
Tranco rank #3,722
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#51
cms.gov
Tranco rank #3,842
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#52
nhtsa.gov
Tranco rank #5,135
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#53
ohio.gov
Tranco rank #5,417
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#54
maryland.gov
Tranco rank #5,750
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#55
samhsa.gov
Tranco rank #5,778
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#56
copyright.gov
Tranco rank #5,924
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#57
hud.gov
Tranco rank #6,160
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#58
gsa.gov
Tranco rank #6,547
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#59
illinois.gov
Tranco rank #6,706
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#60
cpsc.gov
Tranco rank #6,897
AExcellent
0
2 warnings · 6 passed
HTTP→HTTPS Redirect
HTTP returned status 301. Redirect behaviour is ambiguous.
Rank#61
login.gov
Tranco rank #6,943
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#62
medicare.gov
Tranco rank #7,347
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#63
energystar.gov
Tranco rank #7,856
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#64
wi.gov
Tranco rank #8,323
AExcellent
0
2 warnings · 6 passed
HTTP→HTTPS Redirect
Could not check HTTP redirect — port 80 may be blocked or the server is unavailable.
Rank#65
tsa.gov
Tranco rank #8,515
AExcellent
0
2 warnings · 6 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#66
nasa.gov
Tranco rank #400
AExcellent
0
3 warnings · 5 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#67
usda.gov
Tranco rank #845
AExcellent
0
3 warnings · 5 passed
X-Frame-Options
X-Frame-Options is missing. The page can be embedded in iframes, enabling clickjacking.
Rank#68
va.gov
Tranco rank #1,797
AExcellent
0
3 warnings · 5 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#69
clinicaltrials.gov
Tranco rank #3,555
AExcellent
0
3 warnings · 5 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#70
sba.gov
Tranco rank #3,631
AExcellent
0
3 warnings · 5 passed
X-Frame-Options
X-Frame-Options is missing. The page can be embedded in iframes, enabling clickjacking.
Rank#71
federalreserve.gov
Tranco rank #3,912
AExcellent
0
3 warnings · 5 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#72
nsf.gov
Tranco rank #4,524
AExcellent
0
3 warnings · 5 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#73
cdc.gov
Tranco rank #347
AExcellent
0
4 warnings · 4 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#74
fda.gov
Tranco rank #769
AExcellent
0
4 warnings · 4 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#75
nps.gov
Tranco rank #1,838
AExcellent
0
4 warnings · 4 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#76
fcc.gov
Tranco rank #2,796
AExcellent
0
4 warnings · 4 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#77
dot.gov
Tranco rank #2,798
AExcellent
0
4 warnings · 4 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#78
defense.gov
Tranco rank #4,512
AExcellent
0
4 warnings · 4 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#79
in.gov
Tranco rank #4,607
AExcellent
0
4 warnings · 4 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#80
utah.gov
Tranco rank #5,211
AExcellent
0
4 warnings · 4 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#81
supremecourt.gov
Tranco rank #6,252
AExcellent
0
4 warnings · 4 passed
Content Security Policy
No Content-Security-Policy header. The site has no XSS injection restrictions in place.
Rank#82
usa.gov
Tranco rank #2,977
BGood
0
3 warnings · 5 passed
HTTP→HTTPS Redirect
HTTP returned status 404. Redirect behaviour is ambiguous.
Rank#83
tn.gov
Tranco rank #5,820
BGood
0
3 warnings · 5 passed
HTTP→HTTPS Redirect
HTTP returned status 400. Redirect behaviour is ambiguous.
Rank#84
lbl.gov
Tranco rank #5,575
BGood
0
4 warnings · 4 passed
HTTP→HTTPS Redirect
HTTP returned status 301. Redirect behaviour is ambiguous.
Rank#85
hhs.gov
Tranco rank #2,136
BGood
0
5 warnings · 3 passed
HTTP→HTTPS Redirect
HTTP returned status 302. Redirect behaviour is ambiguous.
Rank#86
senate.gov
Tranco rank #2,419
BGood
0
5 warnings · 3 passed
HTTP→HTTPS Redirect
HTTP returned status 301. Redirect behaviour is ambiguous.
Rank#87
eia.gov
Tranco rank #4,064
BGood
0
5 warnings · 3 passed
HTTP→HTTPS Redirect
Could not check HTTP redirect — port 80 may be blocked or the server is unavailable.
Rank#88
maricopa.gov
Tranco rank #1,189
BGood
1
1 warnings · 6 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#89
congress.gov
Tranco rank #2,384
BGood
1
1 warnings · 6 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#90
colorado.gov
Tranco rank #6,166
BGood
1
1 warnings · 6 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#91
maine.gov
Tranco rank #6,668
BGood
1
2 warnings · 5 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#92
texas.gov
Tranco rank #2,744
BGood
1
4 warnings · 3 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#93
faa.gov
Tranco rank #2,923
BGood
1
4 warnings · 3 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#94
dataprivacyframework.gov
Tranco rank #3,459
BGood
1
4 warnings · 3 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#95
nj.gov
Tranco rank #4,956
BGood
1
4 warnings · 3 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#96
mass.gov
Tranco rank #5,109
BGood
1
4 warnings · 3 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#97
michigan.gov
Tranco rank #5,256
BGood
1
4 warnings · 3 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#98
mn.gov
Tranco rank #8,009
BGood
1
4 warnings · 3 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#99
delaware.gov
Tranco rank #8,466
BGood
1
4 warnings · 3 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Rank#100
hawaii.gov
Tranco rank #8,982
BGood
1
4 warnings · 3 passed
HSTS
Strict-Transport-Security header is absent. Browsers won't enforce HTTPS on future visits.
Methodology: the source list was the Tranco daily top 1M downloaded on September 4, 2026, filtered to .gov domains. Vigilai scanned public response headers only: HTTPS reachability, TLS validity, HTTP-to-HTTPS redirect, HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. The first 100 HTTPS-reachable domains were ranked by grade, then failure count, warning count, and source rank. 12 domains were skipped because HTTPS could not be reached during the snapshot.
Source: Tranco daily top 1M domain ranking, filtered to .gov domains. Grades are a point-in-time snapshot and can change when site operators update headers. To check a specific property right now, run a free live scan.