Website Security Statistics 2026: 416 Newly Launched Sites Scanned

We ran a passive security check on 416 newly launched websites — security headers, SSL certificates, DNS records and email spoofing protection. 71.6% ship no Content-Security-Policy. 66% can be impersonated by email. 82.5% have no DNSSEC. And not one of them had a critical vulnerability.

The story people expect about vibe-coded apps is that they are catastrophes. The data says something less dramatic and more useful: they are not broken, they are unhardened, and they are unhardened in exactly the same places as each other.

416

sites scanned, July–August 2026

76.8

average security score out of 100

0

sites with a critical issue

13.5%

ship a real Content-Security-Policy

How we scanned 416 newly launched websites

Every site here is a product someone shipped recently — mostly public launches, plus people who ran our free scanner on their own site. Each domain appears once, using its most recent completed scan.

The check is entirely passive. We read the TLS certificate, the HTTP response headers, cookie flags, public DNS records and public certificate transparency logs. No logins, no forms, no requesting paths an ordinary visitor would not.

Average website security score: 76.8 out of 100

The mean score was 76.8 and the median 78. The lowest site scored 52; four scored a perfect 100. The distribution is a fat middle with no long tail of disasters.

The average site carries 5.4 findings. Almost every one of them is a header that was never set or a DNS record that was never added — not a mistake anyone made, just a step nobody knew was theirs.

The most common website security issues in 2026

Every finding below is free to fix and takes minutes. None of them require changing your application logic.

DMARC adoption: 66% of sites can be email-spoofed

DMARC is the DNS record that tells the world's inboxes what to do with mail claiming to come from your domain. Without it, anyone can send email as [email protected] and it arrives looking real.

37% publish no DMARC record at all. Another 29.3% publish one set to p=none, which reports the forgery to you and delivers it anyway. Taken together, 66% of these products can be impersonated by email, or will only find out after the fact.

A quarter have no SPF record either, and 18.8% have neither. For a product that sends password resets and receipts, that is the difference between a phishing attempt bouncing and a phishing attempt landing.

Custom domain vs platform subdomain: which is more secure?

Sites still on their hosting platform's own subdomain scored better than sites on a domain their owner bought.

The mechanism is not mysterious. A platform subdomain arrives with HTTPS enforced, HSTS set, and DNS you never touch — the platform did the boring parts because the platform owns the domain.

Point your own domain at the same deployment and you silently inherit all of it. Nothing warns you. The deploy still succeeds, the site still loads, and a checklist you never saw goes unticked.

Exposed staging and admin subdomains: 22 of 416 sites

Certificate transparency logs are public. Every TLS certificate ever issued for your domain is listed in them, including certificates for subdomains you assumed were private.

22 of the 416 sites have subdomains discoverable this way that look like they were not meant to be found: 18 staging environments, 9 admin panels, 8 development servers, plus test boxes, old versions and a hosting control panel. One site exposes sixteen — its staging environment is a complete parallel copy of the product, mail server included.

We have named nobody and touched none of those hosts. We only read the public certificate log. Anyone else reading the same log gets the same list, which is the point.

How to fix the most common website security issues

In order of what they buy you per minute spent. None require a rewrite, a dependency, or a vendor.

1. How to add a DMARC record to stop email spoofing

One DNS TXT record at _dmarc.yourdomain.com. Start at p=none to watch what is being sent, then move to p=reject once your legitimate mail passes. This is the most skipped item on the list and the one with a named victim when it goes wrong.

2. How to add Content-Security-Policy, X-Frame-Options and HSTS headers

Roughly 70% of these sites ship none of the three. In Next.js it is a few lines in next.config; on Netlify or Cloudflare it is a config file. We walk through it in how to add security headers in Next.js, and what security headers actually do covers each one in plain English.

3. How to find exposed subdomains in certificate transparency logs

Search your own domain in a certificate transparency log and read what comes back. If a staging, admin or development host is listed, put authentication in front of it or take it off the public internet.

4. How to add a CAA record to restrict certificate issuance

Two minutes, and it stops any certificate authority except the one you name from issuing a certificate for your domain. 82.5% of these sites do not have one.

All four are on the website launch security checklist, alongside the rest of what to check before you ship.

How this website security data was collected

416 distinct domains, each scanned between 12 July and 19 August 2026. Where a site was scanned more than once, only the most recent result counts. Domains that asked to be removed are excluded entirely.

Limitations of this website security sample

This is newly launched indie software, weighted toward products posted somewhere public. It is not the web, not enterprise software, and not a random sample of anything. Read every percentage as “among recently launched indie products”, never as “among websites”.

Individual sites are never named here. Every report is public at our report directory, and any owner can remove theirs without an account.