Defaults.Exposed › Stats › Security grades
What percent of domains fail basic security?
October 2026 census edition
As of October 12, 2026, 74.3% of the 332 million domains graded in the Defaults.Exposed census score an F, 247,066,987 domains failing basic security defaults.
Domains scoring an F: how it is measured
It comes from the existence pass, which unions three source feeds (zone files, DNS measurement data and web crawl data), removes the names that do not exist and the wildcard phantoms, and records which of the scanned domains could be graded. Every domain in the census is measured directly and counted once.
An F records which protections are absent. A domain earns one by publishing none of the externally observable controls that would stop it being impersonated or intercepted, which is also the state a domain sits in when nobody has configured it at all.
The denominator under that share is 332 million: the population where this particular check had something to read. A domain the census could not decide on is recorded as undetermined and left out of it, never counted as a failure.
It moves when domains publish or withdraw the records the grade is built from. One DNS (Domain Name System) record can carry a domain across a grade boundary, which is why the distribution shifts faster than most people expect. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see how the grade is built.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
| Grade | Domains | Share |
|---|---|---|
| A+ | 87,562 | 0.03% |
| A | 613,481 | 0.18% |
| B | 7,227,347 | 2.17% |
| C | 25,913,239 | 7.79% |
| D | 51,583,703 | 15.51% |
| F | 247,066,987 | 74.31% |
Domains scoring an F: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "What percent of domains fail basic security?" (as of October 12, 2026). https://defaults.exposed/stats/what-percent-of-domains-fail-security
Permalink: https://defaults.exposed/stats/what-percent-of-domains-fail-security · Machine-readable: /stats/s/f-rate.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.