Measuring Baseline Web Security Posture: Tier-1 HTTP Security Header Adoption in the Maldives and the WSHS-B Governance Metric

Abstract

Baseline web security configuration is a critical but often overlooked component of national cybersecurity posture, particularly in small and developing digital economies. This study presents a systematic empirical assessment of Tier-1 HTTP security header adoption across 51 Maldivian government and public limited company (PLC) websites, benchmarked against 20 internationally recognised secure domains. To enable reproducible, policy-relevant evaluation, this paper introduces the Website Security Header Score–Benchmark (WSHS-B), a normalised metric quantifying deployment of three foundational browser-enforced controls: Strict-Transport-Security, X-Frame-Options, and X-Content-Type-Options. Only 11.8% of evaluated Maldivian websites implement all three Tier-1 headers; 39.2% implement none and 49.0% partially comply. Benchmark domains achieve near-complete adoption (mean WSHS-B = 0.92) versus 0.35 for Maldivian websites, a gap of 57 percentage points. Mann–Whitney U tests confirm statistically significant differences between groups (p < 0.001), with large rank-based effect sizes (Cliff’s δ ≈ 0.80). Unlike practitioner-facing tools such as Mozilla Observatory and SecurityHeaders.com, which produce composite site-level grades, WSHS-B is purpose-built for population-level governance monitoring through binary, policy-enforceable indicators. To the authors’ knowledge, this is the first nationally scoped empirical baseline of Tier-1 header adoption in the Maldives and the first governance-aligned metric of its kind for small digital economies. The findings provide an evidence base for NCSS 2024–2029 implementation, including mandatory baseline standards, automated compliance monitoring, and targeted capacity development. The methodology is replicable across comparable Small Island Developing States using passive, open-source scanning.

1. Introduction

The rapid expansion of web-based public services has elevated baseline web security configuration from a technical consideration to a foundational requirement for national cybersecurity resilience. Government portals, financial platforms, and public enterprise websites now function as critical access points for sensitive data, transactional services, and citizen engagement. In this context, weaknesses in fundamental security controls expose systems to widely exploited and preventable attack vectors, undermining both operational reliability and public trust. Prior research indicates that a significant proportion of real-world web vulnerabilities arise from misconfigurations and the absence of basic security controls rather than sophisticated zero-day exploits [1,2,3].

Among these foundational controls, HTTP security headers provide a low-cost, browser-enforced mechanism for mitigating common threats such as protocol downgrade attacks, clickjacking, and MIME-type confusion [1,2]. These controls operate at the HTTP response layer and are widely recognised in institutional guidance as essential baseline protections for public-facing web systems [4,5,6]. Despite their recognised importance, the extent to which such controls are systematically implemented across national digital ecosystems remains underexplored, particularly in small and developing digital economies [7]. This gap is especially relevant in contexts where digital service delivery is rapidly expanding but institutional capacity, coordination, and enforcement mechanisms may lag behind policy ambitions [8,9].

At the strategic level, cybersecurity governance has advanced through the Maldives National Cyber Security Strategy (NCSS 2024–2029) and the establishment of the National Cyber Security Agency (NCSA) [6]. The Maldives has experienced rapid digital economy growth, with public services, tourism, and financial transactions increasingly dependent on web-based platforms [10]. However, international assessments and national reporting highlight continuing implementation and capacity gaps across public digital systems [9,11]. This suggests a potential disconnect between cybersecurity policy objectives and operational configuration practices.

Recent incidents reinforce this concern. Public reporting in early 2024 documented service disruptions affecting multiple government websites following suspected cyberattacks [6], while national crime statistics indicate rising cybercrime trends affecting both public and private sectors [12], a pattern consistent with legislative analyses of cybercrime evolution in the Maldives [13,14]. These developments underscore the practical importance of strengthening baseline web security controls.

Despite their recognised importance, no published study has systematically evaluated Tier-1 HTTP security header adoption in the Maldives or quantified its baseline configuration gap relative to internationally recognised secure domains [7].

This study addresses that gap by conducting the first systematic assessment, to the authors’ knowledge, of Tier-1 HTTP security header adoption across 51 Maldivian government and public limited company (PLC) websites. The analysis focuses on three Tier-1 headers, namely, Strict-Transport-Security (HSTS), X-Frame-Options (XFO), and X-Content-Type-Options (XCTO), which are widely treated as minimum baseline controls in government web security guidance [1,5,6]. To enable objective and policy-relevant measurement, this paper introduces the Website Security Header Score–Benchmark (WSHS-B), a normalised metric designed to quantify baseline web security posture and facilitate benchmarking against international best practices.

While prior web measurement studies have examined HTTP security header adoption at scale, relatively few have operationalised baseline browser-enforced controls into a policy-aligned metric suitable for national governance assessment. This study extends existing measurement approaches by embedding Tier-1 header deployment into a reproducible indicator designed for regulatory monitoring and institutional accountability contexts in small digital economies.

The contributions of this paper are fourfold: (i) the first national-level empirical measurement of baseline web security configuration in the Maldives; (ii) the introduction of WSHS-B, whose contribution lies less in its arithmetic form—deliberately a simple, equally weighted proportion of three binary indicators—than in its governance framing: the operationalisation of a minimum, universally mandated, externally observable control set into a transparent, policy-aligned compliance indicator explicitly differentiated from practitioner-facing diagnostic tools such as Mozilla Observatory and SecurityHeaders.com; (iii) statistical evidence quantifying the implementation gap relative to internationally recognised secure domains; and (iv) evidence-based recommendations directly aligned with NCSS 2024–2029 implementation priorities [6,9,15].

This study is guided by the following research questions:

• RQ1: What is the extent of Tier-1 HTTP security header implementation across government and public limited company (PLC) websites in the Maldives?
• RQ2: How does Tier-1 header adoption compare to internationally recognised secure domains, as measured using WSHS-B?
• RQ3: What policy, technical, and operational interventions can be derived to improve national baseline web security posture?

Research Significance

This study carries significance across academic, policy, and societal dimensions. The timing is particularly important: the Maldives National Cyber Security Strategy 2024–2029 was published without a supporting empirical baseline against which implementation progress can be measured. This study contributes to filling that gap by providing NCSA and national policymakers with an independently produced, empirical baseline of web security posture across the public digital estate. The results are immediately actionable: the 57-percentage-point WSHS-B deficiency documented here provides a quantitative foundation for considering specific policy interventions, procurement requirements, and compliance monitoring mechanisms.

For the research community, this study contributes the WSHS-B metric as a replicable, open, governance-oriented measurement instrument that can be applied to any national web estate. Unlike existing practitioner tools, WSHS-B is designed from the outset for regulatory and compliance contexts, making it directly useful for researchers studying cybersecurity governance in low- and middle-income countries, Small Island Developing States, and other settings where institutional capacity constraints make simple, enforceable standards particularly valuable. The lightweight data collection methodology, passive HTTP scanning using open-source tooling, ensures the study is reproducible and extensible without specialised infrastructure or privileged network access.

2. Literature Review

2.1. Baseline Web Security as Foundational Cyber Hygiene

Baseline web security refers to the implementation of foundational configuration controls that mitigate widely exploited attack vectors before more advanced, context-specific protections are layered. Within cybersecurity governance frameworks, such controls are frequently characterised as “minimum viable security” or “cyber hygiene” measures, that is, necessary but not sufficient safeguards that reduce systemic exposure [1,2].

In public-sector environments, baseline controls carry particular importance because web services often interface directly with citizens, financial transactions, and identity systems. Weaknesses in configuration-level defences can therefore generate disproportionate impact relative to their implementation complexity. Prior research demonstrates that many high-frequency web attacks exploit predictable configuration omissions rather than sophisticated zero-day vulnerabilities [2,8].

2.2. HTTP Security Headers in Empirical Web Measurement Research

HTTP security headers represent browser-enforced configuration controls that operate at the HTTP response layer. Unlike application-layer defences embedded in source code, headers are implemented at the server boundary and can reduce exposure independently of internal development practices [2].

Large-scale empirical measurement studies have used HTTP header presence as an externally observable proxy for baseline security posture. Analyses of global domain populations consistently report uneven adoption of core security headers, even among high-visibility websites [2,8,16,17]. Because header deployment can be assessed passively through HTTP response inspection, it provides a reproducible and scalable mechanism for benchmarking configuration-level security maturity.

This measurement approach aligns with broader security research trends that prioritise externally verifiable indicators over self-reported compliance or internal audit data.

2.3. Tier-1 Headers and Institutional Baseline Standards

Although numerous HTTP security headers exist, not all function as universally applicable baseline controls. Research and institutional guidance distinguish between broadly deployable foundational controls and advanced, application-specific policies [15].

Three headers, namely, Strict-Transport-Security (HSTS), X-Frame-Options (XFO), and X-Content-Type-Options (XCTO), are consistently prioritised in government and institutional hardening guidance [5,6]. These controls mitigate well-documented threats and can be implemented through straightforward server-level configuration as presented in Table 1.

Table 1. Tier-1 HTTP Security Headers and Mitigated Threats.

Header	Primary Threat Mitigated	Baseline Security Function
Strict-Transport-Security (HSTS)	Protocol downgrade/Man-in-the-Middle	Enforces HTTPS communication
X-Frame-Options (XFO)	Clickjacking/UI redressing	Restricts page framing
X-Content-Type-Options (XCTO)	MIME-type confusion/Script injection	Prevents content-type sniffing

Importantly, these controls exhibit three properties relevant to benchmarking:

• Binary observability (present/absent),
• Low implementation complexity,
• Policy mandate alignment across multiple jurisdictions.

These characteristics make Tier-1 headers appropriate candidates for standardised baseline measurement.

2.4. Security Benchmarking in Public-Sector Ecosystems

Public-sector digital environments frequently involve distributed service ownership, outsourced development, and heterogeneous infrastructure. In such contexts, centralised assurance of secure configuration can be challenging. Measurement approaches based on externally observable configuration signals offer a practical alternative for assessing system-wide baseline posture [2,7,18].

Transparent and repeatable metrics are particularly valuable in governance settings because they support periodic reassessment, cross-agency comparison, and communication with non-technical stakeholders. A normalised scoring construct such as the Website Security Header Score–Benchmark (WSHS-B) operationalises this principle by translating baseline configuration deployment into a comparable quantitative indicator.

2.5. Existing Web Security Assessment Tools and Their Limitations

Several widely used tools assess HTTP security header deployment in practice. Mozilla Observatory [19] grades websites across a broad set of security attributes, including Content Security Policy, subresource integrity, and cookie configuration, producing a letter grade that reflects overall security posture. SecurityHeaders.com [20], developed by Scott Helme, similarly scans for the presence of multiple HTTP response headers and assigns a grade from A+ to F based on deployment coverage. Hardenize [21] extends this model to include certificate transparency, DNSSEC, and email security controls alongside HTTP headers. These tools serve a valuable diagnostic function for individual site operators and security practitioners undertaking manual assessments.

However, these tools share several characteristics that limit their suitability for national-level governance assessment. First, their grading models incorporate advanced or context-dependent headers, such as Content-Security-Policy, Permissions-Policy, and Expect-CT, whose correct deployment requires application-specific configuration that cannot be validated through header presence alone [22]. A site may receive a low grade for not deploying CSP despite implementing all broadly applicable baseline controls. Second, the grading weights and thresholds are proprietary, subject to change, and not aligned with any formal policy mandate, reducing their comparability across jurisdictions or over time. Third, they are designed for on-demand single-site evaluation rather than systematic population-level monitoring, making large-scale or automated national assessments operationally complex. Fourth, none of these tools produce a metric explicitly intended to measure compliance with government-mandated baseline standards, which is the governance context addressed by this study [8,23].

WSHS-B addresses these limitations by design. Its scope is intentionally restricted to the three Tier-1 headers that are universally mandated or strongly recommended across government web security frameworks, exhibit binary observability, and require no application-specific context for valid assessment. This makes WSHS-B a governance-aligned, policy-enforceable indicator rather than a comprehensive security grade. Whereas tools such as Mozilla Observatory answer the question “how secure is this site overall?”, WSHS-B is designed to answer a narrower but operationally critical question for regulators and policymakers: “has this organisation deployed the mandatory minimum baseline controls that it is expected to have?” This distinction is not merely methodological; it reflects a fundamentally different purpose: institutional accountability and compliance monitoring rather than individual site diagnostics.

To synthesise the relationship between the Maldivian threat environment, governance constraints, and baseline configuration controls, Figure 1 presents the conceptual framework underpinning this study. The framework positions Tier-1 HTTP security headers as measurable, low-complexity controls capable of improving baseline web security posture despite institutional and capacity limitations. Figure 2 presents a proposed system architecture for a full WSHS-B platform that could operationalise this framework as a continuous monitoring and governance tool; this platform is envisaged as future work and is not implemented in the present study.

Figure 1. Conceptual framework underlying this study.

Figure 2. Proposed (future-work) system architecture of the WSHS-B platform for automated monitoring, analysis, and governance of baseline web security across public-sector digital ecosystems. This architecture is a conceptual design and is not implemented in the present study; the empirical results reported here were produced by the lightweight HTTPX-and-parser instantiation described in Section 3, not by this platform. As envisaged, the platform would ingest HTTP response headers from Maldivian government and benchmark domains (Layer 1–2), evaluate the three Tier-1 headers (HSTS, XFO, XCTO) to compute per-site WSHS-B scores (Layer 3), store and analyse results longitudinally (Layer 4), and deliver compliance dashboards, alerts, and reports to policymakers, security teams, and web administrators (Layers 5–7).

2.6. Conceptual Framework

The framework illustrates five interconnected analytical stages linked by a feedback loop for continuous improvement. The threat environment stage characterises the Maldivian context in terms of website disruptions, rising cybercrime, and the growing exposure of public digital services that depend on web platforms for critical government and citizen-facing functions. The governance and implementation constraint stage identifies structural conditions that shape baseline security adoption, including limited cybersecurity expertise, weak enforcement of standards, and fragmented development and hosting practices. The Tier-1 baseline security control stage specifies the minimum viable browser-enforced controls assessed in this study, namely, Strict-Transport-Security (HSTS), X-Frame-Options (XFO), and X-Content-Type-Options (XCTO), each of which can be deployed at low cost via HTTP response headers. The measurement and evaluation stage introduces the WSHS-B metric as a reproducible, policy-aligned instrument that operationalises baseline security posture through the binary assessment of these headers and supports benchmarking against internationally recognised secure domains. The outcome and impact stage situates measurement within a governance context, establishing its relevance for reducing exposure to commodity attacks, achieving configuration consistency across institutions, and strengthening national digital resilience. The feedback loop closes the cycle: measurement results inform policy, capacity development, enforcement, and technical improvements, creating a continuous pathway from observed baseline gaps to improved security posture.

Together, these stages establish the logical structure within which empirical findings are interpreted: observed header adoption rates are treated as externally observable indicators that may reflect underlying governance dynamics, and recommendations are derived from the gap between what governance frameworks require and what the measurement stage reveals. This framework is operationalised in this study through a lightweight instantiation using HTTPX and a custom Python 3.12 parser (described in Section 3); a proposed full platform architecture capable of continuous, automated monitoring is presented as future work in Figure 2.

2.7. Small-State Governance Constraints and Implementation Gaps

Small and developing digital economies frequently encounter structural constraints in cybersecurity governance, including limited specialist capacity, fragmented service procurement, and reliance on contractor-led development models [8,9,24]. These constraints are widely reported in the literature as factors that may contribute to inconsistent implementation of baseline security controls even when policy frameworks formally endorse them.

The Maldives reflects many of these characteristics. While national digitisation initiatives have accelerated online service delivery [10], international assessments highlight ongoing challenges in workforce development, institutional coordination, and operationalisation of cybersecurity standards [9,11]. Public reporting of website disruptions and cyber incidents further underscores exposure at the public web layer [6,12].

2.8. Research Gap and Study Positioning

Existing literature establishes that HTTP security headers function as practical baseline controls [1], that Tier-1 headers are prioritised in institutional hardening guidance [4,5,6], and that governance capacity influences adoption in small digital ecosystems [8,9]. Furthermore, as reviewed in Section 2.5, widely used practitioner tools such as Mozilla Observatory [19], SecurityHeaders.com [20], and Hardenize [21] provide comprehensive site-level diagnostics but are not designed as policy-aligned compliance indicators for national governance monitoring. No published empirical study has systematically measured Tier-1 HTTP security header adoption in the Maldives or quantified the national baseline configuration gap relative to internationally recognised secure domains, nor has a governance-oriented metric been proposed to operationalise mandatory minimum controls for institutional accountability in small digital economies.

This study addresses that gap by introducing WSHS-B, a transparent, policy-aligned metric explicitly designed for governance and compliance monitoring contexts, and applying it to Maldivian government and PLC websites to provide a reproducible national baseline assessment in this domain.

3. Methodology

This study adopts a quantitative, configuration-based measurement approach to assess baseline web security posture across public-facing websites in the Maldives. The methodology is designed to be externally observable, reproducible, and aligned with international guidance on minimum web security controls, as synthesised in the measurement framework presented in Figure 1.

3.1. Sample Selection

The empirical dataset comprises 51 Maldivian websites, including 25 government domains and 26 public limited company (PLC) or state-owned enterprise (SOE) websites.

Government websites were identified through structured extraction of publicly available ministry and statutory body listings and verified against official national sources to confirm operational legitimacy. PLC and SOE domains were sourced from Ministry of Finance public enterprise listings to ensure inclusion of nationally significant entities providing public information or transactional services.

To contextualise findings, a benchmark group of 20 internationally recognised secure domains was constructed. Domains were selected against the following explicit criteria, each of which was independently verified at the time of sample construction:

• Documented adherence to modern web security practices, evidenced by published security disclosure programmes, transparency reports, or recognition in established web security inventories;
• Frequent inclusion as exemplar or reference domains in peer-reviewed large-scale web security measurement studies (e.g., [2,16,17]);
• Consistent deployment of all three Tier-1 HTTP security headers, confirmed by independent passive scanning during the same data collection window.

The benchmark set spans diverse sectors (search, social media, financial services, e-commerce, technology, and large-scale content delivery) to reduce sector-specific bias. The full list of benchmark domains, together with their per-header deployment status and scan dates, is provided in the dataset.

The benchmark group was intentionally designed as an upper-bound implementation reference rather than a peer-equivalent comparison. The objective was not to evaluate whether the Maldivian sample matches the size, sector, or resource profile of the benchmark domains but to evaluate whether universal deployment of Tier-1 controls is operationally achievable across heterogeneous production environments. Government-only or regional-peer comparators were considered but rejected on two grounds: first, they would risk normalising the very deficiencies under investigation, since baseline header adoption is reported as uneven even within high-income government estates [2,16]; second, no comparable national-level dataset of Tier-1 adoption is publicly available for regional peers. A list-based comparator (e.g., Tranco or Alexa top domains) was similarly considered but rejected because such lists prioritise traffic ranking, not security posture, and yield highly variable header adoption [2,17]. The benchmark group therefore functions as an upper-bound implementation reference rather than a peer-equivalent comparator, consistent with prior web measurement studies that employ high-assurance domains to illustrate achievable baseline security standards.

3.2. Data Collection and Header Extraction

HTTP response headers were extracted using the open-source reconnaissance tool HTTPX (ProjectDiscovery, version 1.3.x) during data collection conducted in October 2024. Each domain was queried using the -store-response flag, which preserves the complete raw HTTP response (status line, full header set, and body) for offline inspection. Scans were issued from a single Linux host with default HTTPX timeouts (10 s per request) and a single retry on transient failure. The user agent advertised the default HTTPX identifier; no authentication tokens, cookies, or session state were sent. Each domain was probed first on its canonical hostname (e.g., example.gov.mv) and, where applicable, on its www-prefixed variant; redirect chains were followed up to a maximum of five hops, and the final response after redirects was used for header evaluation.

A custom Python parser performed case-insensitive matching against the response header set to detect the presence of:

• Strict-Transport-Security (HSTS)
• X-Frame-Options (XFO)
• X-Content-Type-Options (XCTO)
• Content-Security-Policy (CSP)
• Referrer-Policy

A header was recorded as present if it appeared in the final response with any non-empty value; the parser did not evaluate the strength or correctness of header directives (e.g., HSTS max-age duration or includeSubDomains usage). This deliberate restriction to presence/absence aligns with the binary observability principle of WSHS-B (Section 3.3). While five headers were collected for descriptive analysis, only the three Tier-1 headers (HSTS, XFO, XCTO) were included in the scoring model.

All measurements were conducted passively through unauthenticated HTTP requests without service interaction or disruption. Domain validation and exclusion criteria are detailed in Section 3.4; following validation, 51 confirmed websites were retained for analysis.

3.3. Website Security Header Score–Benchmark (WSHS-B)

Baseline web security posture was quantified using the Website Security Header Score–Benchmark (WSHS-B), a normalised metric based on the presence of Tier-1 HTTP security headers. The metric operationalises baseline security configuration by measuring the extent to which foundational, browser-enforced controls are deployed on public-facing websites.

For each website j, the score is defined as:

WSHS-B_j = (1/3) Σ_i=1³ h_ij

where:

• i indexes the Tier-1 HTTP security headers (i = 1, 2, 3),
• j indexes the evaluated website, and
• h_ij is a binary indicator equal to 1 if Tier-1 header i is present on website j, and 0 otherwise.

The resulting score ranges from 0 to 1, where 0 indicates the absence of all Tier-1 headers and 1 indicates full adoption. Equal weighting was applied to each header to reflect their shared status as baseline, non-negotiable security controls rather than advanced or context-dependent protections [25].

In baseline regulatory contexts, binary deployment indicators provide enforceable compliance thresholds that are operationally meaningful even when configuration strength varies. The objective of WSHS-B is therefore not to capture nuanced configuration robustness but to assess minimum deploy-or-not consistency across publicly exposed systems. Accordingly, the metric captures baseline deployment rather than configuration quality.

One Tier-1 control warrants explicit treatment. X-Frame-Options (XFO) is now classified as obsolete by current browser and security guidance (MDN, the OWASP Secure Headers Project, and the W3C), which recommends that clickjacking protection be expressed through the Content-Security-Policy frame-ancestors directive rather than XFO alone [5,25]. To preserve construct validity, the clickjacking-protection criterion of WSHS-B is therefore satisfied by either a valid XFO header or a valid CSP frame-ancestors directive; a site that ships frame-ancestors without XFO is credited the corresponding one-third of the score and is not penalised for omitting the legacy header. This substitution rule prevents the metric from rewarding a legacy control over an equivalent or stronger modern one. It should nonetheless be noted as a limitation that, where header presence was recorded without distinguishing the specific clickjacking mechanism deployed, the framing-protection component may marginally understate the posture of sites—particularly modern benchmark domains—that rely on frame-ancestors in place of XFO. The conservative direction of this potential bias (against, not in favour of, the benchmark group) does not weaken the central finding of a substantial Maldivian–benchmark gap.

Unlike the practitioner-facing tools discussed in Section 2.5 (Mozilla Observatory [19], SecurityHeaders.com [20], and Hardenize [21]), which produce composite grades across a broad and variable set of attributes for individual-site diagnostics, WSHS-B is intentionally scoped as a governance-aligned, policy-enforceable compliance indicator. By restricting scope to the subset of controls that are universally mandated, binary in observability, and independently deployable, the metric yields a yes/no compliance determination that is meaningful and enforceable, and its normalised [0, 1] range, equal weighting, and Tier-1 restriction ensure reproducibility, cross-domain comparability, and resistance to gaming—serving the regulator or policymaker rather than the site developer.

3.4. Exclusion Criteria and Data Integrity

To ensure data quality and measurement validity, websites were excluded from analysis if they:

• Returned DNS resolution or SSL/TLS errors,
• Redirected to third-party content unrelated to the intended organisation, or
• Produced incomplete or malformed HTTP responses.

These criteria ensured that only verifiable, operational websites with reliable HTTP response data were included in the final dataset.

3.5. Benchmark Comparison Strategy

The benchmark group was analysed independently and excluded from the Maldivian dataset to avoid inflating national scores. Its role is explicitly aspirational: it establishes an upper-bound implementation reference by representing what is routinely achievable by organisations that treat baseline web security as a standard operational requirement, regardless of organisational size or sector. The benchmark group does not constitute a peer-equivalent comparator in terms of institutional scale, resources, or technical capacity. Rather, consistent with prior web measurement studies that use high-assurance domains as upper-bound references [2,17], it serves to answer a specific analytical question: is there a feasible implementation standard against which observed Maldivian deficiencies can be meaningfully measured? The answer is affirmative. Because Tier-1 HTTP security headers require only server-level configuration, with no dependency on budget, application architecture, or specialist staffing, their near-universal deployment among benchmark domains demonstrates achievability rather than exceptionalism. The gap between Maldivian and benchmark scores should therefore be interpreted as an externally observable implementation difference; the present study does not directly test the underlying causal mechanisms, although the literature on small-state digital governance suggests several plausible contributors (Section 5).

3.6. Statistical Analysis

Descriptive statistics, including the mean, median, and standard deviation, were computed for WSHS-B scores across three groups: Maldivian government websites, Maldivian PLC/SOE websites, and international benchmark websites.

To quantify deviation from ideal baseline security posture, a deficiency score was calculated as:

D = 1 − WSHS-B

where higher values of D indicate greater baseline security gaps.

Inferential analysis employed the Mann–Whitney U test to assess distributional differences between groups. This non-parametric test was selected due to the bounded nature of WSHS-B scores within the range [0, 1], their derivation from discrete binary indicators, and the presence of unequal sample sizes across groups. These characteristics violate the assumptions of normality required for parametric testing, making the Mann–Whitney U test an appropriate choice for robust comparison [26,27].

To complement statistical significance testing, effect sizes were estimated using two measures. Because WSHS-B scores are bounded and discrete (taking only the values 0, 0.33, 0.67, and 1.00), Cohen’s d—which assumes approximately interval-scaled, continuous data—is reported only as an indicative measure and is interpreted with caution. The primary effect-size measure is therefore the rank-based Cliff’s delta (equivalently, the rank-biserial correlation derived from the Mann–Whitney U statistic as r = 1 − 2U/(n₁n₂)), which makes no distributional or scale assumptions and is appropriate for ordinal and bounded data. Following established thresholds, |δ| values of 0.474 or above are interpreted as large, 0.33–0.474 as medium, 0.147–0.33 as small, and below 0.147 as negligible.

Effect-size analysis further supports the interpretation of results by quantifying the magnitude of observed differences beyond statistical significance. The rank-based Cliff’s delta values for the Maldivian–benchmark comparisons (|δ| ≈ 0.79–0.80) fall well above the conventional large-effect threshold, and the indicative Cohen’s d values (d > 1.9) are consistent with this interpretation, together indicating substantial and practically meaningful disparities in baseline web security posture between Maldivian and benchmark domains.

3.7. Visualisation

To support interpretation, bar charts were used to compare WSHS-B distributions across groups, while radar charts illustrated header-level adoption patterns by category (government, PLC/SOE, and international benchmark). These visualisations reveal implementation asymmetries, highlight outliers, and provide intuitive insight into baseline security posture beyond numerical summaries.

3.8. Reproducibility and Data Availability

To support full reproducibility and independent verification, the complete site-level dataset is available from the corresponding author on reasonable request. The dataset includes, for every domain in the Maldivian and benchmark samples: organisational category (Government, PLC/SOE, or International benchmark); canonical domain; final URL after redirects; HTTP status code of the final response; presence/absence of each of the five collected response headers (HSTS, XFO, XCTO, CSP, Referrer-Policy); the computed WSHS-B score; and the scan date. The same dataset underlies all descriptive statistics, distributional summaries, and inferential tests reported in Section 4; no separate or filtered subset was used for any individual table or figure. The analysis scripts (HTTPX invocation, Python header parser, and statistical analysis notebook) accompany the dataset to enable end-to-end replication. This approach is consistent with emerging best practice in web measurement research, which emphasises reproducible and archivable measurement artefacts [28,29].

4. Results and Contributions

This section presents the empirical findings of the study and evaluates disparities in baseline web security posture between Maldivian public-facing websites and internationally recognised benchmark domains using the Website Security Header Score–Benchmark (WSHS-B).

4.1. Descriptive Analysis of WSHS-B Scores

Across the 51 Maldivian websites evaluated, baseline security deployment was consistently limited relative to benchmark domains (Figure 3 and Figure 4 and Table 2). Government websites recorded a mean WSHS-B score of 0.32 (SD = 0.35), while PLC/SOE websites recorded a comparable mean score of 0.37 (SD = 0.34). In contrast, benchmark domains achieved a mean score of 0.92 (SD = 0.18), indicating near-universal Tier-1 header implementation.

Figure 3. Distribution of Tier-1 HTTP security header implementation across all sampled websites.

Figure 4. Mean WSHS-B scores by group.

Table 2. Descriptive statistics of WSHS-B scores across evaluated groups.

Group	N	Mean WSHS-B	Median WSHS-B	Std. Deviation	Avg. Deficiency
Government	25	0.32	0.33	0.35	0.68
PLC	26	0.37	0.33	0.34	0.63
International	20	0.92	1.00	0.18	0.08

When expressed as baseline deficiency (1 − WSHS-B), Maldivian government and PLC/SOE websites exhibited average deficiency levels of 0.68 and 0.63, respectively, compared to 0.08 for benchmark domains. This reflects an absolute baseline gap of 57 percentage points between the combined Maldivian sample (mean WSHS-B = 0.35) and internationally recognised secure implementations.

Figure 3 illustrates the distribution of Tier-1 HTTP security header implementation across all sampled websites. The pattern reveals more than simply low compliance: 39.2% of Maldivian sites have implemented no Tier-1 controls, while a further 49.0% have implemented only one (29.4%) or two (19.6%) of the three controls, and only 11.8% have implemented all three. This distribution, right-skewed and heavily concentrated toward the lower end, indicates that partial adoption is in fact common and that complete non-adoption, while the single largest category, is not the dominant mode in the strict sense. The analytical implication is twofold. First, the substantial group of partially compliant sites (49.0% of the sample) suggests that adoption decisions are made on a header-by-header basis rather than as an all-or-nothing package and that progress toward full compliance can be achieved incrementally for many sites. Second, the large zero-adoption cluster (39.2%) suggests that baseline security configuration is not part of standard deployment practice for a substantial subset of sites, indicating that any intervention strategy needs to address both initial-adoption and incremental-improvement audiences. The benchmark group’s concentration at full compliance (WSHS-B = 1.00) further demonstrates that complete baseline implementation is operationally feasible across heterogeneous web infrastructure, consistent with the observation that these controls require only server-level configuration. The observed pattern directly supports RQ1 and establishes that observed deficiencies are widespread rather than incidental.

Figure 4 presents the mean WSHS-B scores across the three evaluated groups. The most analytically important observation is not simply that Maldivian scores are low but that government and PLC/SOE scores are statistically indistinguishable from each other (p = 0.546) while both are substantially separated from benchmark scores (p < 0.001, d > 1.9). This pattern is not consistent with a sector-specific explanation for the deficiency: it is not the case that government sites are markedly less secure than commercial ones, or vice versa. Instead, the convergence on similarly low scores across organisationally distinct groups is consistent with a common ecosystem-level factor; the absence of enforceable baseline standards at the national level is one plausible candidate, although the present data cannot rule out other explanations. The benchmark mean of 0.92 (SD = 0.18) also warrants attention: the relatively low standard deviation is consistent with high compliance being routinely achieved among organisations that treat baseline security as a default practice. The implication for the Maldivian context is that the gap is unlikely to be primarily a resource-constraint problem, since the controls in question are inexpensive, and is more plausibly attributable to governance and implementation practice. This interpretation directly addresses RQ2 and provides the empirical foundation for the recommendations in Section 6.

Table 2 presents descriptive statistics for WSHS-B scores across the three evaluated groups, providing a quantitative overview of baseline web security posture. Maldivian government and PLC/SOE websites exhibit low mean scores (0.32 and 0.37, respectively), with comparable median values, indicating consistently limited adoption of Tier-1 security headers across both groups. The standard deviations (0.35 and 0.34) reflect the underlying four-point WSHS-B scale (0, 0.33, 0.67, 1.00) on which sites are distributed across all four levels, signalling heterogeneity in implementation across individual websites.

In contrast, international benchmark domains demonstrate a substantially higher mean score (0.92) and median of 1.00, indicating near-universal adoption of baseline controls with much less variation. When expressed as deficiency (1 − WSHS-B), Maldivian websites exhibit markedly higher average deficiency levels (0.68 for government and 0.63 for PLC/SOE) compared to 0.08 for benchmark domains. This disparity highlights a pronounced baseline security gap and supports the conclusion that foundational security controls are not systematically embedded within the Maldivian public web ecosystem.

4.2. Distribution of Tier-1 Header Adoption

Header adoption patterns reveal substantial configuration heterogeneity within the Maldivian sample. Six websites (11.8%) implemented all three Tier-1 headers, while 20 websites (39.2%) implemented none. The remaining 25 websites (49.0%) implemented one (n = 15, 29.4%) or two (n = 10, 19.6%) of the three controls. By contrast, 80% of benchmark domains implemented full Tier-1 compliance, and no benchmark domain implemented zero headers.

Government and PLC/SOE adoption patterns were broadly similar, suggesting that baseline configuration gaps may be ecosystem-wide rather than sector-specific. The absence of clear intra-national differentiation is consistent with the possibility that observed deficiencies reflect governance and implementation factors affecting the broader public web ecosystem, although direct evidence of these mechanisms is beyond the scope of the present externally observable measurement.

Beyond the aggregate counts above, the three Tier-1 controls were not necessarily adopted at uniform rates across the sample; the per-header adoption profile for each group (Government, PLC/SOE, and benchmark) is visualised in the category radar chart. The complete per-domain, per-header deployment status (HSTS, XFO, and XCTO individually) underlying these patterns is provided in full in the full dataset, enabling per-header adoption rates for each group to be derived directly and supporting independent verification and re-analysis.

Table 3 details the distribution of Tier-1 HTTP security header adoption across government, PLC/SOE, and benchmark websites, offering a granular view of implementation patterns. The results indicate that only a small proportion of Maldivian websites achieve full compliance, with just six sites (11.8%) implementing all three Tier-1 headers. A further 25 sites (49.0%) implement one or two headers, and 20 sites (39.2%) implement none, indicating widespread but uneven absence of basic security controls.

Table 3. Distribution of Tier-1 HTTP security header adoption across website categories.

Number of Headers Implemented	Government	PLC	International
3 (All headers)	3	3	16
2	4	6	3
1	7	8	1
0 (None)	11	9	0

Intermediate adoption levels (one or two headers) are distributed across both government and PLC/SOE groups, illustrating inconsistency in configuration practices. Notably, adoption patterns are highly similar between the two groups, consistent with the observation that baseline security deficiencies are ecosystem-wide rather than sector-specific.

In comparison, benchmark domains demonstrate a markedly different distribution, with 80% achieving full compliance and no sites lacking all Tier-1 headers. This contrast underscores the extent of the implementation gap and highlights the feasibility of achieving high baseline security standards under established best practices.

4.3. Statistical Comparison with Benchmark Websites

To assess whether observed disparities were statistically significant, Mann–Whitney U tests were conducted. Differences between Maldivian government websites and benchmark domains, as well as between PLC/SOE websites and benchmark domains, were statistically significant (p < 0.001 in both comparisons). No statistically significant difference was observed between government and PLC/SOE groups (p = 0.546).

Effect-size analysis further confirms the magnitude of disparity. The rank-based Cliff’s delta—the primary effect-size measure given the bounded, discrete nature of WSHS-B scores—was 0.80 (government vs. benchmark) and 0.79 (PLC/SOE vs. benchmark), both well above the 0.474 large-effect threshold; the indicative Cohen’s d values of 2.05 and 1.90, respectively, are consistent with this conclusion. By contrast, the government vs. PLC/SOE comparison yielded a negligible Cliff’s delta of 0.10, consistent with the non-significant Mann–Whitney result. These results indicate that the observed baseline security gap relative to benchmark domains is not only statistically significant but substantively meaningful, as summarised in Table 4 and Table 5.

Table 4. Mann–Whitney U Test Results.

Comparison Group	U Statistic	p-Value	Interpretation
Government vs. International	50	<0.001	Significant difference
PLC vs. International	55	<0.001	Significant difference
Government vs. PLC	294	0.546	No significant difference

Table 5. Effect sizes (rank-based Cliff’s δ and indicative Cohen’s d).

Comparison	Cliff’s δ (Primary)	Cohen’s d (Indicative)	Effect Magnitude
Government vs. International	0.80	2.05	Large
PLC vs. International	0.79	1.90	Large
Government vs. PLC	0.10	—	Negligible

4.4. Mapping of Results to Research Questions

This subsection maps the empirical findings to the study’s research questions. Interpretation and policy implications are addressed in Section 5.

• RQ1: What is the extent of Tier-1 HTTP security header implementation across Maldivian websites? Among the 51 Maldivian public-facing websites analysed, six (11.8%) implemented all three Tier-1 headers, 20 (39.2%) implemented none, and 25 (49.0%) implemented one or two of the three controls. Government and PLC/SOE websites exhibited comparable levels of adoption, indicating a uniformly low baseline security posture across publicly visible systems.
• RQ2: How does adoption compare with international best practices? The mean WSHS-B score for Maldivian websites (0.35) was substantially lower than that of the international benchmark group (0.92). In deficiency terms, this corresponds to an average baseline security shortfall of 65% for Maldivian websites compared to 8% for benchmark sites, representing an absolute gap of 57 percentage points in WSHS-B score.
• RQ3: What insights can be derived to improve national web security posture? The observed adoption patterns reveal substantial gaps in baseline security configuration across both government and PLC/SOE websites. These results provide an empirical basis for examining policy, operational, and capability-oriented interventions, which are discussed in the following section.

4.5. Research Contribution Summary

Table 6 summarises the research contributions of this study, mapping each empirical finding to its academic implication, policy relevance, and the stakeholder group most directly served. This mapping makes explicit how the quantitative results translate into actionable knowledge for distinct audiences.

Table 6. Research Contribution Summary: Findings, Implications, and Impact.

Finding	Academic Contribution	Policy/Practical Impact	Primary Stakeholder
Only 11.8% of Maldivian public websites implement all Tier-1 headers; 39.2% implement none and 49.0% partially comply (October 2024)	First nationally scoped empirical baseline for Maldivian public web security; establishes quantitative foundation for longitudinal comparison	Provides quantitative evidence to support consideration of mandatory Tier-1 header deployment under NCSS 2024–2029	NCSA, policymakers, government web administrators
Government and PLC/SOE scores statistically indistinguishable (p = 0.546); both significantly below benchmark (p < 0.001, d > 1.9)	Indicates the deficiency is ecosystem-level (not sector-specific), pointing toward governance-related rather than purely sector-specific factors	Cross-sector policy intervention is warranted; sector-specific approaches alone are likely insufficient	NCSA, national cybersecurity regulators
Right-skewed distribution: zero adoption is the largest category (39.2%), but partial compliance (49.0%) is also widespread	Identifies a mixed adoption landscape requiring both initial-adoption and incremental-improvement strategies	Two complementary intervention designs are needed: new-deployment defaults and remediation drives for partially compliant sites	Government ICT officers, procurement agencies, web vendors
Introduction of the WSHS-B metric: normalised [0, 1], binary, policy-aligned, reproducible	New governance-oriented measurement instrument that fills a gap between practitioner diagnostic tools (Mozilla Observatory, SecurityHeaders.com) and policy compliance monitoring; replicable across national web estates	Provides regulators with an enforceable compliance threshold metric; directly applicable in procurement criteria, audit frameworks, and national dashboards	Cybersecurity researchers, national CERTs, regulatory bodies in SIDS and developing digital economies
Plausible structural contributors discussed in the literature (contractor-led development, limited DevSecOps integration, absence of centralised enforcement)	Frames externally observable measurements within the small-state digital governance literature; identifies hypotheses for future qualitative investigation	Suggests three intervention points worth exploring: procurement criteria, DevSecOps adoption, and centralised enforcement	NCSA, Ministry of Finance, government procurement agencies, IT vendors

5. Discussion

The findings of this study reveal a substantial and consistent deficiency in baseline web security configuration across Maldivian public-facing websites. As demonstrated in Section 4, 39.2% of the evaluated domains lack all three Tier-1 HTTP security headers, 49.0% deploy only one or two of the three controls, and only 11.8% achieve full compliance. The consistently low mean WSHS-B scores observed across both government (0.32) and PLC/SOE (0.37) websites, combined with the absence of statistically significant differences between these groups, are consistent with baseline security weaknesses being widespread across the public web ecosystem rather than confined to a particular sector.

When benchmarked against internationally recognised secure domains, the magnitude of this disparity becomes more pronounced. Benchmark websites exhibit near-complete implementation (mean WSHS-B = 0.92), with statistical analysis confirming significant differences (p < 0.001) and large effect sizes (Cohen’s d > 1.9). These results show that the observed baseline security gap, 57 percentage points in WSHS-B score, is both statistically robust and practically meaningful, consistent with foundational configuration controls not being systematically institutionalised.

5.1. Interpretation in Relation to Measurement Framework

Within the measurement framework adopted in this study, Tier-1 HTTP security headers represent minimum viable security controls: low-complexity, browser-enforced mechanisms that mitigate widely exploited attack vectors. The WSHS-B metric operationalises this concept by capturing the presence or absence of these controls as a baseline indicator of configuration hygiene. The observed clustering of Maldivian websites at low WSHS-B values (as illustrated in Figure 3 and Figure 4) is consistent with these minimum controls not being embedded as default practice across publicly accessible systems.

Importantly, given the low complexity and minimal resource requirements associated with Tier-1 header deployment, deficiencies of this scale are unlikely to be primarily attributable to infrastructural constraints. Plausible contributing factors, such as governance, coordination, and enforcement gaps, are discussed below; the present externally observable measurement does not directly test these mechanisms but is consistent with their operation.

5.2. Governance and Institutional Implications

The similarity in baseline security scores between government and PLC/SOE domains is consistent with the absence of centralised or enforceable baseline configuration standards across the national web ecosystem. In distributed digital environments, where service development may involve multiple agencies, vendors, and outsourcing arrangements, consistent implementation of security controls cannot be assumed without formal governance mechanisms.

The findings therefore provide empirical support for the proposition that policy articulation alone is unlikely to ensure operational security outcomes. While national strategies such as NCSS 2024–2029 establish high-level cybersecurity objectives, the lack of observable baseline controls is consistent with a gap between strategic intent and implementation practice. This pattern highlights the importance of translating policy into enforceable technical standards and measurable compliance requirements.

Several structural factors plausibly contribute to the low and uniform adoption rates observed across the Maldivian sample, although the present study does not directly measure them and they should be regarded as hypotheses for future targeted investigation. First, a significant proportion of government and PLC websites are reportedly procured through external contractors and vendors rather than developed in-house, a pattern consistent with small-state digital governance models [8,9]. Contractor-led development pipelines that lack explicit security acceptance criteria may create conditions in which basic server hardening is omitted at deployment and not subsequently corrected. Second, limited adoption of DevSecOps practices, that is, the integration of security review into continuous development and deployment workflows, could allow configuration drift and initial misconfiguration to persist undetected across the infrastructure lifecycle [23]. Third, the apparent lack of a centralised enforcement or audit mechanism may mean that even agencies aware of the relevant guidance face limited accountability consequences for non-compliance. Together, these factors are consistent with a systemic governance pattern rather than isolated technical negligence; however, confirming this interpretation would require complementary qualitative research, including interviews with procurement officers and IT staff, analysis of vendor contracts and acceptance testing artefacts, and process review of agency development workflows, all of which are beyond the scope of the present externally observable measurement study.

5.3. Risk Implications in the Maldivian Context

In the Maldivian digital environment, characterised by reliance on web-based government services, tourism platforms, and financial systems, the absence of foundational browser-enforced protections increases exposure to high-frequency, low-complexity attacks. Threats mitigated by Tier-1 headers, including clickjacking, protocol downgrade, and MIME-type confusion, are well documented and widely exploited, featuring prominently in current threat intelligence assessments [30]. Their absence therefore represents a preventable risk rather than an unavoidable vulnerability.

Furthermore, the observed heterogeneity in partial adoption (one or two headers across nearly half of the sample) suggests inconsistent implementation practices, plausibly influenced by decentralised development processes and varying levels of technical oversight. Without standardised configuration baselines or automated monitoring, security posture becomes dependent on individual implementation decisions, resulting in uneven protection across publicly exposed systems.

5.4. Scope and Measurement Considerations

The WSHS-B metric is intentionally designed to measure baseline deployment rather than configuration robustness. While the presence of a header does not guarantee optimal policy configuration, its absence indicates a missed opportunity for low-cost risk mitigation. This distinction is critical: this study does not aim to assess comprehensive web security maturity but to evaluate whether foundational, widely recognised baseline controls are consistently implemented.

From a governance perspective, baseline deployment represents a necessary precondition for more advanced security practices. The findings therefore highlight a fundamental layer of security that warrants attention before higher-order controls can be effectively realised.

6. Policy and Operational Recommendations

The empirical findings presented in Section 4, together with the governance analysis in Section 5, support a set of targeted recommendations directed at national policymakers, regulatory agencies, and public-sector web administrators. These recommendations are presented as practical, evidence-informed proposals that follow from the observed baseline gap; the underlying causal interpretations should be regarded as plausible rather than empirically demonstrated by the present study. Recommendations are organised across three levels: policy and governance, operational implementation, and capacity development.

6.1. Establish Mandatory Baseline Configuration Standards

The National Cyber Security Agency (NCSA) could consider issuing a formal technical directive mandating the deployment of Tier-1 HTTP security headers (HSTS, XFO, and XCTO) on all government and state-owned enterprise websites. Such a directive would benefit from specifying minimum configuration parameters (e.g., HSTS max-age of at least 31,536,000 s), establishing a compliance timeline, and designating a responsible authority for enforcement. Embedding these requirements within procurement and service acceptance criteria for government digital platforms would extend coverage to contractor-managed systems, which may represent a significant portion of the observed non-compliant sites. This approach would be consistent with cross-sector cybersecurity performance goal frameworks adopted in comparable governance contexts [31].

6.2. Integrate Automated Compliance Monitoring

Manual, point-in-time assessments are unlikely to be sufficient for sustaining baseline security posture across a distributed public web ecosystem. NCSA could establish a continuous, automated scanning capability, modelled on existing national web observatories in comparable jurisdictions, that periodically measures Tier-1 header deployment across all in-scope government and PLC domains. Scan results could feed into a centralised compliance dashboard accessible to designated agency security officers, enabling proactive identification of regressions, newly deployed sites lacking headers, and persistent non-compliant domains. Periodic public reporting of aggregate compliance rates would create accountability incentives and allow longitudinal tracking of national security posture improvement.

6.3. Strengthen Technical Capacity and Awareness

The low and broadly uniform adoption rates across government and PLC/SOE websites are consistent with the possibility that the primary barrier to compliance is awareness and implementation knowledge rather than technical complexity. Targeted capacity-building initiatives could be developed, including server-configuration guidance tailored to the web frameworks and hosting environments most commonly used across Maldivian public-sector deployments, practitioner training modules for government ICT officers covering baseline web security hygiene, and vendor engagement programmes that incorporate Tier-1 header requirements into standard deliverables for government website projects. These initiatives would benefit from coordination with the NCSS 2024–2029 workforce development priority to ensure alignment with existing capacity-building infrastructure [32].

6.4. Align with NCSS 2024–2029 Implementation Priorities

The recommendations above are directly actionable within the governance structures described in NCSS 2024–2029 [6]. Establishing mandatory baseline configuration standards would address the strategy’s objective of operationalising minimum cybersecurity requirements across public digital infrastructure. Automated monitoring aligns with the strategy’s emphasis on measurable outcomes and continuous improvement. Capacity development initiatives map onto the workforce and awareness priorities that the strategy identifies as critical enablers. Together, these measures represent a low-cost, high-impact pathway for translating strategic intent into observable, verifiable improvements in national web security posture.

7. Conclusions

This study provides, to the authors’ knowledge, the first nationally scoped empirical baseline for Tier-1 HTTP security header adoption across the Maldivian public digital estate and introduces the Website Security Header Score–Benchmark (WSHS-B) as a replicable, governance-aligned measurement instrument for national-level compliance monitoring. These twin contributions address a gap that has persisted despite the launch of the Maldives National Cyber Security Strategy 2024–2029: the absence of independent, quantitative evidence of baseline web security posture against which strategic objectives can be measured. The results are clear. Only 11.8% of evaluated Maldivian government and PLC/SOE websites implement all three Tier-1 headers, while 39.2% implement none and a further 49.0% implement only one or two: a pattern that, while widespread, is now documented with statistical rigour sufficient to support evidence-based regulatory deliberation.

The 57-percentage-point WSHS-B deficiency documented between Maldivian websites (mean = 0.35) and internationally recognised benchmark domains (mean = 0.92), confirmed with large effect sizes (Cohen’s d > 1.9) and high statistical significance (p < 0.001), establishes that the observed gap is not an artefact of sample variation but a robust feature of the national web ecosystem at the time of measurement. The statistical indistinguishability of government and PLC/SOE scores (p = 0.546) is consistent with an ecosystem-level pattern: one that a cross-sector mandatory baseline standard would be well positioned to address, and one that individual agency action alone is unlikely to resolve.

The WSHS-B metric introduced here addresses a specific and previously unaddressed gap between practitioner diagnostic tools, which produce composite grades unsuitable for regulatory monitoring, and formal audit processes, which are too resource-intensive for continuous population-level assessment. By restricting scope to three universally mandated, binary, independently deployable controls, WSHS-B produces scores that are directly mappable to policy mandates, resistant to manipulation, and reproducible through passive external scanning without privileged access. This makes it immediately applicable as the measurement instrument for a national web security compliance dashboard, as part of government procurement acceptance criteria, and as a tracking mechanism for NCSS 2024–2029 implementation progress.

Beyond the Maldivian context, this study establishes a precedent and a template. The measurement methodology (passive HTTP scanning, binary header assessment, WSHS-B scoring, and Mann–Whitney U comparison against an upper-bound benchmark) requires no specialised infrastructure, no privileged access, and no large research budget. Any national CERT, regulatory body, or research team in a comparable Small Island Developing State or developing digital economy can replicate this study within days using open-source tooling. The result is a scalable pathway for converting the global aspiration of “minimum viable web security” into a measurable, country-specific compliance indicator: grounded in evidence, aligned with national strategy, and actionable by the institutions responsible for delivering it. The societal stakes are concrete: the Maldivian websites currently lacking full Tier-1 coverage serve citizens, tourists, and businesses across a digital economy in which web-based transactions are central to daily activity, and remediation—achievable through server-level configuration changes at negligible cost—would measurably reduce their exposure to clickjacking, protocol-downgrade, and MIME-type-sniffing attacks.

8. Limitations and Future Research

Several limitations should be acknowledged. First, WSHS-B measures the presence of Tier-1 HTTP security headers but does not assess configuration quality (e.g., HSTS max-age strength or policy robustness). The metric therefore captures baseline deployment rather than comprehensive application security maturity. Second, the dataset reflects a point-in-time scan conducted in October 2024; header deployment status may have changed since measurement, and findings should be interpreted as a baseline snapshot rather than a continuous assessment of current posture.

Third, the study evaluates publicly observable HTTP responses and does not examine internal system architecture, secure development lifecycle practices, or vulnerability exposure beyond header configuration. Importantly, the present study cannot directly establish the underlying causes of the observed baseline gap. Interpretations advanced in Section 5 and Section 6 regarding contractor-led procurement, DevSecOps maturity, and enforcement mechanisms are framed as plausible hypotheses informed by the small-state digital governance literature, not as findings demonstrated by the externally observable header data. Confirming or refuting these interpretations would require complementary qualitative research, including practitioner interviews, procurement contract analysis, vendor capability assessment, and DevSecOps process review.

Fourth, the benchmark group, while constructed to represent internationally recognised secure domains, serves as an upper-bound reference rather than a peer-equivalent comparison in institutional scale or resources. Relatedly, the sample sizes are modest—51 Maldivian sites against 20 benchmark domains—and the groups are unequal. While the Maldivian sample is designed to be near-comprehensive of the national government and PLC/SOE web estate rather than a probabilistic draw, and while the non-parametric tests and rank-based effect sizes used here are appropriate for small, unequal groups, the modest benchmark size means the upper-bound reference should be read as illustrative of achievable practice rather than as a statistically representative population. Larger and regionally diversified benchmark sets would strengthen the external generalisability of the comparison.

Fifth, and most fundamentally, this study measures one specific, well-defined layer of web security posture—the deployment of three browser-enforced Tier-1 HTTP response headers—and does not evaluate transport-layer security (TLS/cipher configuration), Content-Security-Policy quality, cookie security attributes, DNSSEC, vulnerability or patch exposure, authentication strength, or application-layer security. WSHS-B should therefore be understood as a baseline configuration-hygiene indicator rather than a comprehensive measure of overall web security. Where the term “national baseline web security posture” is used in this paper, it refers specifically to this baseline header layer and not to a holistic security assessment of the national web estate; the broader posture would require the additional, complementary measurements listed above, which we identify as priorities for future work. A natural extension is to develop a tiered family of indicators (e.g., a Tier-2 measure incorporating TLS, CSP quality, and cookie flags) layered on top of the present Tier-1 baseline. Finally, because the parser recorded header presence rather than directive strength, this study does not report HSTS configuration depth (max-age duration, includeSubDomains, or preload-list readiness) or the robustness of individual directives; quantifying these attributes is a worthwhile direction for subsequent configuration-quality studies.

Future research may extend this work in several directions. Longitudinal assessment would enable evaluation of baseline security improvements over time, particularly in response to regulatory or governance interventions. Mixed-methods studies pairing WSHS-B measurement with qualitative investigation of procurement, development, and enforcement practices would directly test the governance interpretations hypothesised here. Comparative analyses across additional Small Island Developing States (SIDSs) or developing digital economies could further contextualise structural implementation challenges. Finally, integrating qualitative assessment of header configuration strength or advanced security controls may provide deeper insight into web security maturity beyond baseline hygiene.