Profscann research
The State of Web Security
What we actually find when we scan real websites. Every figure below comes from live Profscann scans — aggregated, anonymous, and updated automatically.
Sites analysed
237
Average security score
54/100
Average SEO score
93/100
What most websites get wrong
Percentage of scanned sites failing each check.
83% have no CAA record restricting certificate issuance
197 sites
68% have not enabled DNSSEC
160 sites
61% have no DMARC record, so their email can be spoofed
144 sites
59% have no Content-Security-Policy
139 sites
48% have no Referrer-Policy
114 sites
44% have no clickjacking protection
105 sites
43% do not enforce HTTPS with HSTS
103 sites
41% allow browsers to MIME-sniff responses
97 sites
39% have no SPF record
92 sites
34% leak their exact software versions
81 sites
How sites score overall
A
11%
25
B
18%
42
C
36%
85
D
13%
31
F
23%
54
Based on 237 completed scans. Aggregated and anonymous — no individual site, owner or result is identified. Last updated Sun, Nov 8, 2026 2:40 PM.
How does your site compare?
Run a free scan and find out in about a minute — with the exact fixes for your setup.
Scan my website