Does Cloudflare Make You Safer? 41.9M Domains Graded
Published
Figures as of 2026-08-16 · methodology v9. This is a recurring report; each edition re-measures the same population so the numbers can be tracked over time. All figures are aggregate — we never publish an individual business’s grade or name an individual registrant’s domain.
The short answer: no for the floor, yes for the ceiling
67.7% of the 41.9 million domains fronted by Cloudflare still grade F in our census — essentially identical to the 68.0% F-rate of every other server we can see. Putting the world’s most popular reverse proxy in front of your website does not, on the evidence of 205 million graded HTTP responses, rescue you from a failing grade.
Then the same dataset turns around and says something else entirely. A Cloudflare-fronted domain is 2.3 times as likely to score B or better. And of the 40,092 A+ grades in the entire server-visible web, 19,527 sit behind Cloudflare. One provider, 22% of the cohort, nearly half of the elite.
Both findings are true at once, and the tension between them is the actual story. A CDN fixes the part of your security posture it can reach. The part it can’t reach is the part most failing domains fail on.
Key numbers
- 41,854,808 domains answered our scans with
Server: cloudflarein the August 2026 census — 20.4% of the 205.1 million graded responses that declare a server at all. - 67.66% of Cloudflare-fronted domains grade F, versus 67.97% for the rest of the server-visible web. The gap is 0.3 percentage points — measurable at these cohort sizes, but immaterial.
- 4.05% of Cloudflare-fronted domains reach B or better, versus 1.78% of everything else: a 2.3× multiplier.
- 48.7% of all A+ grades in the server-visible cohort (19,527 of 40,092) sit behind Cloudflare, from 21.9% of the domains.
- Cloudflare’s D-rate is 16.6% versus 22.0% for the rest — fronting visibly shifts mass out of D and into C and B. It just doesn’t touch F.
- As a second lens on scale: 42,255,941 domains delegate their DNS to cloudflare.com nameservers — the two measurement bases agree to within 1.0%.
What we actually compared
Every domain in our census that answered over HTTP gets its Server response header recorded. 376.9 million graded responses came back; 205.1 million of them declared a server. We took the first word of that header, grouped domains by it, and crossed the groups against the domain’s overall security grade — the full A+-to-F verdict across email authentication, TLS and certificates, web-security headers and DNS, not a web-only score.
Server: cloudflare is Cloudflare’s own stamp. When Cloudflare fronts a site, its edge answers the request, so the header identifies the Cloudflare-fronted cohort cleanly — 41.9 million domains. The comparison set is everything else that declares a server: nginx, Apache, LiteSpeed, IIS, the hosting-platform proxies, all of it, 163.3 million domains.
That framing matters. The “rest” cohort is mostly origin servers answering naked, with no CDN or WAF between them and the internet. So this is close to the cleanest available large-scale test of the question people actually ask: does putting Cloudflare in front make the measurable posture better?
Does Cloudflare reduce your chance of a failing grade?
No. This is the finding we did not expect to be this flat.
| Grade | Cloudflare-fronted (41.9M) | Everything else (149.4M) |
|---|---|---|
| A+ | 0.047% | 0.014% |
| A | 0.17% | 0.07% |
| B | 3.83% | 1.70% |
| C | 11.70% | 8.20% |
| D | 16.59% | 22.05% |
| F | 67.66% | 67.97% |
Read the F row first. Two out of three domains fail, and it makes almost no difference whether Cloudflare is in front. Whatever pushes a domain into an F, the CDN does not reach it.
Now read upward and the pattern flips. Cloudflare’s D-rate is 5.5 points lower. Its C-rate is 3.5 points higher, its B-rate more than double, its A-rate 2.4×, its A+-rate 3.4×. The distribution hasn’t shifted; it has stretched. Fronting takes domains that were already passing and moves them up bands, while the failing two-thirds stay exactly where they were.
Why doesn’t a CDN fix an F?
Because most of what a failing domain is missing lives in DNS and email, and a reverse proxy never sees either.
Here is the mechanism, stated as interpretation of the grade structure rather than a per-domain measurement. Cloudflare’s proxy handles what passes through it: it terminates TLS with a current certificate and modern protocol versions, redirects HTTP to HTTPS, and can inject headers like HSTS. Those are real checks in our methodology and Cloudflare-fronted domains benefit — that is the visible stretch at the top of the table.
But our grade also weighs SPF, DMARC, DNSSEC and CAA — records the owner has to create. A proxy cannot publish your DMARC policy. It cannot sign your zone. Across the whole census those are precisely the checks the failing majority fails: only 28.3 million of 432 million scanned domains publish a DMARC rua reporting address at all, and DMARC enforcement is rarer still. A domain with no email authentication and no DNS hardening starts so deep in the hole that a perfect web tier cannot dig it out.
The irony is sharp in Cloudflare’s case specifically. The same dashboard that fronts the website also serves the DNS zone where the missing records would go — labelled as product knowledge: those DNS features exist on the free tier. The gap between 67.7% F and the 4.1% who reach B or better is not a paywall. It is a to-do list nobody opened.
How does Cloudflare compare with running nginx or Apache naked?
The brief-level comparison, server by server:
| Server cohort | Domains | F | C or better | B or better |
|---|---|---|---|---|
| cloudflare | 41,854,886 | 67.66% | 15.75% | 4.05% |
| nginx | 35,784,836 | 70.26% | 9.90% | 1.56% |
| apache | 31,286,558 | 67.67% | 8.62% | 1.25% |
| openresty | 12,380,167 | 73.02% | 7.37% | 1.06% |
| litespeed | 9,351,021 | 55.66% | 9.46% | 0.91% |
| squarespace | 8,749,531 | 50.24% | 24.50% | 5.83% |
| vercel | 3,492,060 | 49.93% | 30.31% | 7.22% |
| microsoft-iis | 2,441,352 | 73.89% | 7.36% | 1.49% |
Cloudflare’s F-rate matches Apache’s to the second decimal place — 67.66% against 67.67% — which is almost comically tidy evidence that fronting doesn’t move the failure floor. Where Cloudflare separates is above the line: 15.75% at C or better against Apache’s 8.62% and nginx’s 9.90%.
Two platform cohorts beat Cloudflare on the floor. Squarespace and Vercel hold F-rates near 50%, well under everyone else’s. The likely reason is instructive: those are managed platforms whose customers often buy the domain through the platform too, so sane defaults get applied end to end. LiteSpeed’s 55.66% F is the best of the self-managed servers, and its cohort skews toward commercial shared hosting where the host, again, configures more of the stack. The pattern across the whole table points one way — the more of the stack someone competent manages for you, the better your floor; what you bolt on in front matters much less.
The elite is disproportionately orange
The top of the grade curve belongs to Cloudflare in a way the middle does not.
| Cohort share | Cloudflare-fronted |
|---|---|
| Of all server-visible domains | 21.9% |
| Of all B grades | 38.8% |
| Of all A grades | 40.2% |
| Of all A+ grades | 48.7% |
Half the A+ tier, from a fifth of the web. The selection-effect caveat below applies at full strength here, but the concentration is worth sitting with. We showed in our grade-curve work that the internet’s top 1% starts at a score of just 83 — the elite is small and the bar is low. This table says that thin elite has largely converged on the same front door. When 19,527 of the web’s 40,092 best-configured domains route through one company’s edge, grade concentration has quietly become an infrastructure-concentration question too, the same shape we found in certificate issuance and DMARC reporting.
The mandatory caveat: Cloudflare users are not average users
Nothing above shows Cloudflare causing better grades, and the correlation almost certainly overstates any causal effect.
Putting a domain behind Cloudflare takes a deliberate act: signing up, changing nameservers, thinking about your website as a thing that needs infrastructure. The population that does this skews professional, technical, attentive. Those same people are far more likely to publish a DMARC record or enable DNSSEC — the checks the proxy can’t touch. Some unknown share of the 2.3× B-or-better multiplier is the person, not the product.
The F row is what makes this dataset better than a testimonial, though. If self-selection alone drove posture, the Cloudflare cohort should fail less often. It doesn’t — 41.9 million self-selected, above-average-attention domains fail at the same rate as the naked web. The most defensible reading of both rows together: the kind of owner who sets up Cloudflare and then also does the DNS and email work ends up near the top, and the kind who sets it up and stops ends up exactly where they started. The proxy is one step on a path, and most of its users take no further steps.
How we measured this
- Population: 205,120,104 graded census rows whose HTTP response carried a
Serverheader, from the August 2026 round. Figures as of 2026-08-16, methodology v9. The full graded-response universe is 376,928,781 rows, of which 205,120,104 declared a server; our server × grade table covers 99.8% of those (the top 400 server-grade combinations — the residue is a long tail of rare servers). - Basis: this article uses the graded-rows basis throughout. Our site-wide headline F-rate (73.8%) uses a broader basis that counts dead domains as F; the two are not comparable and we do not mix them here.
- Cohort assignment is the first word of the self-declared
Serverheader, lowercased.cloudflareidentifies Cloudflare’s edge because the edge answers the request. - The grade is the domain’s overall security grade across our externally observable checks — email authentication, TLS and certificates, web-security headers, DNS — not a web-only or CDN-only score.
- Server-header blind spot: 171.8 million graded responses carry no
Serverheader at all and are excluded from every figure here. CDNs and WAFs that strip or don’t stamp the header are invisible on this basis, so 41.9M is a floor for Cloudflare’s true footprint, and the “everything else” cohort may contain domains fronted by non-stamping CDNs. The independent DNS-delegation lens (42.3M domains on cloudflare.com nameservers) lands within 1.0% of the header count, which gives us reasonable confidence in the cohort’s scale. - Self-declared header:
Serveris whatever the responding software chooses to say. Behind a CDN the origin’s server is masked; the nginx and Apache cohorts are therefore “visibly naked” populations, not a census of all nginx or Apache installations. - Zero cells: where a server-grade combination doesn’t appear in our top-400 table (for example LiteSpeed A+), the true count is below the table’s inclusion cutoff of roughly 2,300 domains, not necessarily zero. We report percentages accordingly and avoid claiming exact zeros.
- Correlation, not causation. CDN adoption is a proxy for owner attention, organisation size and technical maturity. The provider does not create most of the records the grade depends on; SPF, DMARC and DNSSEC live in the owner’s zone. Nothing here should be read as Cloudflare — or any server — causing a grade.
- Plan-level claims: we cannot see which Cloudflare plan a domain uses. Statements about free-tier feature availability are labelled product knowledge, not census data.
- Aggregate only. We publish cohort statistics; we never name or grade an individual registrant’s domain.
- Data is stored and processed within the EU.
What this means
For IT and security teams evaluating Cloudflare as part of a security posture review, the data has a clear message: Cloudflare improves the checks it touches — TLS termination, HTTPS redirection, HSTS headers — and does nothing for the checks it cannot touch. SPF, DMARC, DNSSEC, and CAA records live in the DNS zone the domain owner controls, not in Cloudflare’s infrastructure. If your domain is failing on those checks, adding Cloudflare in front of the web tier will not fix them. The 67.7% F-rate among Cloudflare-fronted domains is proof that 41.9 million organisations made this exact mistake.
For organisations already using Cloudflare, the practical action is to open the Cloudflare dashboard and check the DNS zone. Cloudflare hosts your DNS alongside the CDN. The records that separate a failing grade from a passing one — SPF, DMARC, DNSSEC, CAA — can be published directly in the same dashboard where you manage your proxy settings. None of them require a paid plan. The 4.05% of Cloudflare-fronted domains that reach B or better are not paying more; they are doing more.
For business owners deciding whether to use Cloudflare, the answer depends on what you are trying to fix. If your domain is failing because of weak TLS, missing HTTPS redirect, or no HSTS header, Cloudflare addresses those immediately. If your domain is failing because of missing DMARC, absent SPF, or no DNSSEC — which is why most domains fail — Cloudflare’s proxy layer does not help and the work remains to be done regardless of what sits in front of your web server.
Data to cite
- “67.66% of the 41,854,808 Cloudflare-fronted domains grade F in the August 2026 census — essentially identical to the 67.97% F-rate of all other server-visible domains.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “Cloudflare-fronted domains reach B or better at 4.05% versus 1.78% for the rest of the server-visible web — a 2.3x multiplier — but the F-rate gap is only 0.3 percentage points.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “19,527 of the 40,092 A+ grades in the server-visible web sit behind Cloudflare — 48.7% of the elite from 21.9% of the domains.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “Squarespace and Vercel — managed platforms that configure more of the stack end-to-end — hold F-rates of 50.24% and 49.93%, substantially below Cloudflare’s 67.66%.” — defaults.exposed August 2026 Domain Security Census (432M domains)
- “42,255,941 domains delegate their DNS to cloudflare.com nameservers in the August 2026 census — within 1.0% of the 41.9 million counted by Server header, cross-validating the cohort size.” — defaults.exposed August 2026 Domain Security Census (432M domains)
FAQ
Does using Cloudflare improve your security grade? It correlates with a better one at the top of the scale and an identical one at the bottom. Cloudflare-fronted domains reach B or better at 4.05% versus 1.78% for the rest of the server-visible web (2.3×), but they grade F at 67.66% versus 67.97% — no meaningful difference. The proxy improves the checks it touches; most failing domains fail on checks it can’t touch.
Why do two-thirds of Cloudflare sites still fail? Because the grade weighs email authentication (SPF, DMARC) and DNS hardening (DNSSEC, CAA) alongside web security, and a reverse proxy cannot publish those records for you. As of 2026-08-16, the failing majority of the web is missing exactly those owner-created records, Cloudflare-fronted or not.
How many domains actually use Cloudflare? At least 41.85 million graded domains answered our August 2026 scans through Cloudflare’s edge, out of 205.1 million responses that declared a server. That is a floor: it counts only domains where Cloudflare’s header is visible. A second, independent measure — 42.26 million domains delegating DNS to cloudflare.com nameservers — agrees closely.
Is Cloudflare’s free plan enough to get a good grade? The census cannot see plan tiers, so we can’t split the cohort by price. What the data does show is that the tools sufficient for a strong grade — TLS, HTTPS redirection, HSTS, plus the DNS zone where SPF, DMARC, DNSSEC and CAA records go — are available on Cloudflare’s free tier (product knowledge, not census data). The 4.05% who reach B or better and the 67.66% who fail have access to substantially the same features.
Is a CDN or a managed platform better for security? On floors, the managed platforms win: Squarespace-fronted domains fail at 50.24% and Vercel at 49.93%, versus Cloudflare’s 67.66%. On ceilings, Cloudflare holds nearly half of all A+ grades. Platforms configure more of the stack for you; a CDN gives an attentive owner more room to excel and an inattentive one nothing at all.
What specific checks does Cloudflare help with and which does it not? Cloudflare’s proxy helps with: TLS certificate validity, modern TLS protocol support, HTTPS redirection, and HSTS header injection — all of which require the CDN to be in front of your web traffic. It does not help with SPF, DMARC, DKIM, DNSSEC, or CAA records, because those live in your DNS zone and must be published by you regardless of what fronts your web tier.
What is the trend compared to July 2026? This August 2026 census establishes the first per-server-cohort grade breakdown at this scale. Future editions will track whether the Cloudflare F-rate moves relative to the rest of the web as more Cloudflare users complete their DNS and email configuration. The 67.66% F-rate and 48.7% A+ share are the August 2026 baseline.
Related reading
- The Web Server Census 2026 →
- How Much of the Web Hides Behind a WAF or CDN →
- The Internet Security Grade Curve →
See where your own domain stands
Check your domain free at defaults.exposed — see whether adding Cloudflare has actually moved your security grade or whether the DNS and email checks are still failing behind the CDN. Takes 30 seconds. No account needed.
Read the flagship census report: The State of Domain Security 2026 →
Aggregate data only. Data stored and processed in the EU.
How to cite this report
Press / blog: defaults.exposed (2026). Does Cloudflare Make You Safer? 41.9M Domains Graded. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/does-cloudflare-make-you-safer
Academic: defaults.exposed. (2026, August 18). Does Cloudflare Make You Safer? 41.9M Domains Graded. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/does-cloudflare-make-you-safer
In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=205,120,104 server-declaring HTTP responses)
About the defaults.exposed August 2026 Census
The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.
Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026