{
    "title": "Security headers on Nepali government websites",
    "auditDate": "2026-09-05",
    "published": "2026-09-15",
    "sample": "30 .gov.np domains, each verified by DNS and an HTTP response before inclusion",
    "method": "One passive HEAD request per domain over HTTPS, following up to four redirects; response headers only. No scanning or probing.",
    "author": {
        "name": "Diwakar Bhatt",
        "url": "https://diwakarbhatt.com.np/about.html"
    },
    "article": "https://diwakarbhatt.com.np/blog/nepal-gov-website-security-headers.html",
    "counts": {
        "respondsOverHttps": 30,
        "validTlsCertificate": 30,
        "strictTransportSecurity": 2,
        "contentSecurityPolicy": 6,
        "xFrameOptions": 26,
        "xContentTypeOptions": 26,
        "referrerPolicy": 26,
        "permissionsPolicy": 1,
        "noneOfTheSixHeaders": 4,
        "disclosesServerHeader": 27,
        "disclosesXPoweredBy": 5,
        "endOfLifeOpenSsl102Disclosed": 4,
        "largestGroupOnOneIpAddress_recountedAtPublication": 14
    },
    "limitations": [
        "Response headers only; says nothing about application security, patching or access control.",
        "Individual domains are not published.",
        "Headers can change after the audit date."
    ]
}