Profscann research
The State of Web Security
What we actually find when we scan real websites. Every figure below comes from live Profscann scans — aggregated, anonymous, and updated automatically.
Sites analysed
222
Average security score
54/100
Average SEO score
93/100
What most websites get wrong
Percentage of scanned sites failing each check.
83% have no CAA record restricting certificate issuance
185 sites
67% have not enabled DNSSEC
148 sites
59% have no DMARC record, so their email can be spoofed
131 sites
58% have no Content-Security-Policy
129 sites
47% have no Referrer-Policy
105 sites
45% do not enforce HTTPS with HSTS
100 sites
43% have no clickjacking protection
95 sites
40% allow browsers to MIME-sniff responses
88 sites
36% have no SPF record
81 sites
35% leak their exact software versions
77 sites
How sites score overall
A
10%
23
B
19%
42
C
36%
79
D
12%
26
F
23%
52
Based on 222 completed scans. Aggregated and anonymous — no individual site, owner or result is identified. Last updated Thu, Oct 8, 2026 12:24 AM.
How does your site compare?
Run a free scan and find out in about a minute — with the exact fixes for your setup.
Scan my website