The State of Website Security 2026
How secure is the average website in 2026?
Not very. Across 600 automated scans of 25 real websites, the average site scored just 80/100 – a “C” grade. The overwhelming majority are missing basic security headers, fail Google’s Core Web Vitals, and have email-spoofing protection (DMARC) misconfigured or missing entirely.
Published: 2026-06-27 · FortifyNet · Hakan Fagnell
What the data covers
The headline numbers
How common is each problem?
Share of tested websites affected by each issue. Each metric uses only the sites actually tested for that category.
Security grade distribution
Every website graded A–F on its overall security score.
The most common issues we find
Ranked by how often each issue appears across all scans.
of scans
Key statistics (quotable)
Clean, citable facts. Source line included for each.
76.2% of websites fail Google's Core Web Vitals performance thresholds.
FortifyNet, State of Website Security 2026, based on 600 scans across 25 domains.
84% of websites have missing or misconfigured DMARC email-spoofing protection.
FortifyNet, State of Website Security 2026, based on 600 scans across 25 domains.
80% of websites are missing a Content-Security-Policy header.
FortifyNet, State of Website Security 2026, based on 600 scans across 25 domains.
The average website scores 80 out of 100 on overall security – a "C" grade.
FortifyNet, State of Website Security 2026, based on 600 scans across 25 domains.
Only 16% of websites earn an "A" security grade, while 8.0% score a "D" or "F".
FortifyNet, State of Website Security 2026, based on 600 scans across 25 domains.
48% of websites do not enforce HTTPS with an HSTS header.
FortifyNet, State of Website Security 2026, based on 600 scans across 25 domains.
How does your website score?
Run the same audit on your own site – free, in about 60 seconds. No account required.
Run a free scanFrequently asked questions
Methodology
FortifyNet continuously runs automated, non-intrusive security audits on websites submitted by users and customers. Each audit checks SSL/TLS configuration, DNS and email-authentication records (SPF, DKIM, DMARC, DNSSEC, CAA), HTTP security headers, Core Web Vitals performance, and dark-web exposure. The figures in this report are aggregated from 600 completed scans across 25 distinct websites and 9,508 individual findings. “Percent of tested” metrics use only the sites where that specific category could be measured. All data is fully anonymized – no domain names, organizations, or personal data are included. This is a real, transparent dataset; the sample is modest and skews toward small and mid-size websites, so treat it as a directional snapshot rather than a census of the entire web.
Honest sample size: 25 websites · 600 scans · 9,508 findings.