How many websites fail Core Web Vitals?

88.4% of tested websites fail at least one of Google's Core Web Vitals thresholds (LCP, CLS or interactivity).

Where does this data come from?

From 7,145 automated, anonymized security scans run by FortifyNet across 56 real websites, recording 68,238 individual findings. No domain names or personal data are included.

Original Research · 2026

The State of Website Security 2026

Q: How secure is the average website in 2026?

The average website scores 71.1 out of 100 — a "C" grade. Only 8.9% earn an "A".

How secure is the average website in 2026?

Not very. Across 7,145 automated scans of 56 real websites, the average site scored just 71.1/100 — a “C” grade. The overwhelming majority are missing basic security headers, fail Google’s Core Web Vitals, and have email-spoofing protection (DMARC) misconfigured or missing entirely.

Published: 2026-06-27 · FortifyNet · Hakan Fagnell

What the data covers

7,145

automated scans

websites analyzed

68,238

issues detected

71.1/100

average security score

The headline numbers

88.4%

Fail Core Web Vitals

80.4%

DMARC missing or misconfigured

79.1%

Missing Content-Security-Policy

How common is each problem?

Share of tested websites affected by each issue. Each metric uses only the sites actually tested for that category.

Fail Core Web Vitals88.4%

DMARC missing or misconfigured80.4%

Missing Content-Security-Policy79.1%

Missing X-Frame-Options62.8%

Missing HSTS55.8%

DNSSEC not enabled41.2%

Dark-web exposure found34.5%

SSL/TLS issues19.6%

Expired or expiring certificate13.7%

SPF missing9.8%

Security grade distribution

Every website graded A–F on its overall security score.

8.9%

19.6%

39.3%

17.9%

14.3%

The most common issues we find

Ranked by how often each issue appears across all scans.

1CAA record missing – anyone can issue SSL certs for your domain

93.4%

2Content-Security-Policy (CSP) missing – XSS attacks possible

80.2%

3Permissions-Policy missing

74.6%

4Referrer-Policy missing – URL information may leak

63.6%

5X-Frame-Options missing – clickjacking attacks possible

60.5%

6DMARC in monitoring mode (p=none) – no active protection

48.5%

7Reduce unused JavaScript

45.8%

8Reduce unused CSS

45.3%

9Email accounts exposed in data breaches

44.6%

10HSTS (HTTP Strict Transport Security) missing

44.6%

of scans

Key statistics (quotable)

Clean, citable facts. Source line included for each.

88.4% of websites fail Google's Core Web Vitals performance thresholds.
FortifyNet, State of Website Security 2026, based on 7,145 scans across 56 domains.

80.4% of websites have missing or misconfigured DMARC email-spoofing protection.
FortifyNet, State of Website Security 2026, based on 7,145 scans across 56 domains.

79.1% of websites are missing a Content-Security-Policy header.
FortifyNet, State of Website Security 2026, based on 7,145 scans across 56 domains.

The average website scores 71.1 out of 100 on overall security — a "C" grade.
FortifyNet, State of Website Security 2026, based on 7,145 scans across 56 domains.

Only 8.9% of websites earn an "A" security grade, while 32.2% score a "D" or "F".
FortifyNet, State of Website Security 2026, based on 7,145 scans across 56 domains.

55.8% of websites do not enforce HTTPS with an HSTS header.
FortifyNet, State of Website Security 2026, based on 7,145 scans across 56 domains.

How does your website score?

Run the same audit on your own site — free, in about 60 seconds. No account required.

Run a free scan

Frequently asked questions

Most do. 79.1% of websites lack a Content-Security-Policy header and 55.8% are missing HSTS, based on 7,145 scans across 56 websites in FortifyNet's State of Website Security 2026.

Methodology

FortifyNet continuously runs automated, non-intrusive security audits on websites submitted by users and customers. Each audit checks SSL/TLS configuration, DNS and email-authentication records (SPF, DKIM, DMARC, DNSSEC, CAA), HTTP security headers, Core Web Vitals performance, and dark-web exposure. The figures in this report are aggregated from 7,145 completed scans across 56 distinct websites and 68,238 individual findings. “Percent of tested” metrics use only the sites where that specific category could be measured. All data is fully anonymized — no domain names, organizations, or personal data are included. This is a real, transparent dataset; the sample is modest and skews toward small and mid-size websites, so treat it as a directional snapshot rather than a census of the entire web.

Honest sample size: 56 websites · 7,145 scans · 68,238 findings.