Defaults.Exposed › Stats › Combined exposure
How many domains have zero baseline security controls?
As of July 28, 2026 · census snapshot 2026-07-28
As of July 28, 2026, 23,298,293 domains — 8.5% of the 276 million graded in the Defaults.Exposed census — deploy none of the five baseline controls (SPF, enforcing DMARC, DNSSEC, HTTPS, HSTS).
| Controls deployed | Domains | Share |
|---|---|---|
| 0 of 5 (fully exposed) | 23,298,293 | 8.45% |
| 1 of 5 | 107,302,883 | 38.92% |
| 2 of 5 | 108,519,087 | 39.37% |
| 3 of 5 | 29,461,853 | 10.69% |
| 4 of 5 | 6,249,650 | 2.27% |
| 5 of 5 (fully locked) | 834,509 | 0.30% |
Cite this
Statistic current as of July 28, 2026. Recomputed from the live census each edition; the number on this page and the machine-readable twin always match. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "How many domains have zero baseline security controls?" (as of July 28, 2026). https://defaults.exposed/stats/how-many-domains-have-zero-security-controls
Permalink:https://defaults.exposed/stats/how-many-domains-have-zero-security-controls · Machine-readable:fully-exposed.json · Licence:open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.