Measuring Baseline Web Security Posture: Tier-1 HTTP Security Header Adoption in the Maldives and the WSHS-B Governance Metric

Baseline web security configuration is a critical but often overlooked component of national cybersecurity posture, particularly in small and developing digital economies. This study presents a systematic empirical assessment of Tier-1 HTTP security header adoption across 51 Maldivian government and public limited company (PLC) websites, benchmarked against 20 internationally recognised secure domains. To enable reproducible, policy-relevant evaluation, this paper introduces the Website Security Header Score–Benchmark (WSHS-B), a normalised metric quantifying deployment of three foundational browser-enforced controls: Strict-Transport-Security, X-Frame-Options, and X-Content-Type-Options. Only 11.8% of evaluated Maldivian websites implement all three Tier-1 headers; 39.2% implement none and 49.0% partially comply. Benchmark domains achieve near-complete adoption (mean WSHS-B = 0.92) versus 0.35 for Maldivian websites, a gap of 57 percentage points. Mann–Whitney U tests confirm statistically significant differences between groups (p < 0.001), with large rank-based effect sizes (Cliff’s δ ≈ 0.80). Unlike practitioner-facing tools such as Mozilla Observatory and SecurityHeaders.com, which produce composite site-level grades, WSHS-B is purpose-built for population-level governance monitoring through binary, policy-enforceable indicators. To the authors’ knowledge, this is the first nationally scoped empirical baseline of Tier-1 header adoption in the Maldives and the first governance-aligned metric of its kind for small digital economies. The findings provide an evidence base for NCSS 2024–2029 implementation, including mandatory baseline standards, automated compliance monitoring, and targeted capacity development. The methodology is replicable across comparable Small Island Developing States using passive, open-source scanning.