Defaults.Exposed › Stats › Combined exposure
How many security controls does the average domain deploy?
As of July 28, 2026 · census snapshot 2026-07-28
As of July 28, 2026, the average domain in the Defaults.Exposed census deploys 1.60 of the five baseline security controls (SPF, enforcing DMARC, DNSSEC, HTTPS, HSTS) across 276 million graded domains.
| Controls deployed | Domains | Share |
|---|---|---|
| 0 of 5 (fully exposed) | 23,298,293 | 8.45% |
| 1 of 5 | 107,302,883 | 38.92% |
| 2 of 5 | 108,519,087 | 39.37% |
| 3 of 5 | 29,461,853 | 10.69% |
| 4 of 5 | 6,249,650 | 2.27% |
| 5 of 5 (fully locked) | 834,509 | 0.30% |
Cite this
Statistic current as of July 28, 2026. Recomputed from the live census each edition; the number on this page and the machine-readable twin always match. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "How many security controls does the average domain deploy?" (as of July 28, 2026). https://defaults.exposed/stats/how-many-security-controls-does-the-average-domain-deploy
Permalink:https://defaults.exposed/stats/how-many-security-controls-does-the-average-domain-deploy · Machine-readable:average-controls.json · Licence:open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.