Website Security Statistics 2026: How 101 Top Websites Score
Updated October 31, 2026 · SecScanner Team · Original data
We ran 24 automated, non-intrusive security checks against 101 of the most-visited websites, from Google and Amazon to banks, airlines and government portals. The median site scores 63/100. 87% have no effective Content Security Policy, and 52% do not enforce HSTS.
Key findings
- 97% of top websites fail the Trusted Types readiness check (98 of 101).
- 93% of top websites fail the Cross-Origin Resource Isolation check (94 of 101).
- 87% of top websites fail the Content Security Policy (CSP) check (88 of 101).
- 73% of top websites fail the Permissions-Policy header check (74 of 101).
- 63% of top websites fail the HSTS Preload Readiness check (64 of 101).
- 62% of top websites fail the Referrer Policy check (63 of 101).
- No site failed these checks: Deprecated TLS versions, Directory Listing Detection, HTTPS enabled, Mixed Content, TLS Version.
- The average score is 63/100; only 5% of sites score 80 or higher.
Which security checks do top websites fail most?
Share of sites failing each check. A check that could not run on a site (for example, a timeout) is left out of that check's total rather than counted as a failure.
| Check | Category | Priority | Sites failing | Fail rate |
|---|---|---|---|---|
| Trusted Types readiness | Headers | medium | 98 / 101 | 97% |
| Cross-Origin Resource Isolation | Headers | medium | 94 / 101 | 93% |
| Content Security Policy (CSP) | Headers | critical | 88 / 101 | 87% |
| Permissions-Policy header | Headers | medium | 74 / 101 | 73% |
| HSTS Preload Readiness | TLS | low | 64 / 101 | 63% |
| Referrer Policy | Headers | medium | 63 / 101 | 62% |
| Security.txt (RFC 9116) | Content | low | 62 / 101 | 61% |
| HSTS enabled | Headers | critical | 53 / 101 | 52% |
| Robots.txt Security Audit | Content | low | 53 / 101 | 52% |
| Frame Security Policy | Headers | high | 43 / 101 | 43% |
| Set-Cookie headers | Headers | high | 42 / 101 | 42% |
| X-Content-Type-Options header | Headers | medium | 40 / 101 | 40% |
| Deprecated X-XSS-Protection header | Headers | low | 39 / 101 | 39% |
| Reverse Tabnabbing Protection | Content | medium | 30 / 99 | 30% |
| Content-Type header | Headers | medium | 21 / 101 | 21% |
| HTTP to HTTPS Redirect | TLS | high | 19 / 101 | 19% |
| Server information disclosure | Headers | low | 15 / 101 | 15% |
| Certificate Expiry | TLS | high | 6 / 101 | 6% |
| Cipher Suite | TLS | medium | 1 / 101 | 1% |
| Deprecated TLS versions | TLS | critical | 0 / 101 | 0% |
| Directory Listing Detection | Content | medium | 0 / 101 | 0% |
| HTTPS enabled | TLS | critical | 0 / 101 | 0% |
| Mixed Content | TLS | high | 0 / 99 | 0% |
| TLS Version | TLS | critical | 0 / 101 | 0% |
How are security scores distributed?
| Score band | Sites | Share |
|---|---|---|
| Good (80–100) | 5 | 5% |
| Fair (60–79) | 48 | 48% |
| Needs work (40–59) | 48 | 48% |
| Critical (0–39) | 0 | 0% |
Which industries have the most secure websites?
| Industry | Sites | Average score |
|---|---|---|
| Crypto & Web3 | 5 | 72/100 |
| Developer Tools | 9 | 71/100 |
| Email & Communication | 5 | 68/100 |
| Finance & Banking | 8 | 66/100 |
| SaaS & Productivity | 10 | 66/100 |
| Media & News | 8 | 65/100 |
| Cloud & Hosting | 6 | 62/100 |
| Government | 5 | 62/100 |
| Big Tech | 7 | 61/100 |
| Social Media | 8 | 60/100 |
| Travel | 5 | 59/100 |
| Healthcare | 5 | 58/100 |
| Education | 7 | 57/100 |
| E-Commerce | 8 | 56/100 |
| Gaming | 5 | 56/100 |
Industry groups hold 5–10 sites each, so treat small differences as noise. Per-site results are in the security reports directory.
Methodology
- Sample: 101 popular websites across 15 industries, chosen for traffic and recognition, not at random. Big sites are not representative of the web as a whole.
- Checks: the 24 checks of SecScanner's free tier (TLS, HTTP security headers, content), out of 62 in the full scan. Each check only reads what any browser receives: no logins, no attack payloads.
- Scope: the homepage response of each domain. A header set only on other pages or subdomains is not seen.
- Score: passed checks as a share of checks that ran, 0–100.
- Period: scans from October 31, 2026 to October 31, 2026. Sites are re-scanned automatically and this page updates with them.
How to cite
SecScanner, “Website Security Statistics 2026”, https://secscanner.app/research/website-security-statistics, data as of October 31, 2026.
How does your site compare?
Run the same 24 checks on your website for free. Results in 1–3 minutes, no signup.
Scan Your Website Free