Profscann research
The State of Web Security
What we actually find when we scan real websites. Every figure below comes from live Profscann scans — aggregated, anonymous, and updated automatically.
Sites analysed
217
Average security score
54/100
Average SEO score
93/100
What most websites get wrong
Percentage of scanned sites failing each check.
83% have no CAA record restricting certificate issuance
181 sites
67% have not enabled DNSSEC
145 sites
59% have no Content-Security-Policy
128 sites
59% have no DMARC record, so their email can be spoofed
128 sites
47% have no Referrer-Policy
103 sites
46% do not enforce HTTPS with HSTS
99 sites
43% have no clickjacking protection
93 sites
40% allow browsers to MIME-sniff responses
86 sites
37% have no SPF record
80 sites
34% leak their exact software versions
73 sites
How sites score overall
A
10%
22
B
19%
42
C
35%
76
D
12%
25
F
24%
52
Based on 217 completed scans. Aggregated and anonymous — no individual site, owner or result is identified. Last updated Thu, Sep 24, 2026 5:38 AM.
How does your site compare?
Run a free scan and find out in about a minute — with the exact fixes for your setup.
Scan my website