Defaults.Exposed › Reports

The Top 1% of the Internet Starts at a B

Published 2026-08-20

Figures as of 2026-08-16 (August 2026 round) — methodology v9. This is a recurring report; each edition re-measures the same population so the numbers can be tracked over time. All figures are aggregate — we never publish an individual business’s grade.

The headline: the top 1% of the internet starts at a B

We scored 376,928,781 domains on a 100-point security scale, and entry to the top 1% of the entire internet is a score of 82 — a B grade. Not an A. Not a perfect score. A B.

Fewer than 73,000 of those 377 million domains — 72,216, to be exact — earn an A+. That is 0.019% of the measured web, roughly one domain in every 5,220. Broaden the bar to “A or better” and you still capture only 549,635 domains: 0.15% of everything we graded.

We went into this analysis expecting to find the digital equivalent of a wealth pyramid: a comfortable elite at the top, a broad middle, a struggling base. That is not what the data shows. What it shows is stranger, and — for anyone who runs a domain — considerably more useful. The wealth-gap framing survives about halfway down this page before the data dismantles it.

Key findings

• Entry to the top 1% of all measured domains is a score of 82/100 — a B grade. You join the web’s security elite with a B.
• Only 0.15% of domains (549,635 out of 376.9 million) score an A or better. A+ domains number 72,216 — 0.019%, about 1 in 5,220.
• The median domain scores 45/100 — an F. Under the methodology’s grade bands (A+ ≥95, A ≥90, B ≥80, C ≥70, D ≥60, F below 60), the exact middle of the internet is a failing grade.
• 56.9% of all graded domains — 214,351,307 of them — score below 50/100. More than half the web doesn’t reach the halfway mark.
• The mean score is 38.34/100, pulled meaningfully below the median by the large mass of domains scoring at or near zero. There is no long tail of excellence dragging the average up.
• The Gini coefficient of security scores is 0.370. By the standard measure of inequality, this reflects a distribution with a concentrated bottom — 24.5% of domains score exactly 0 — and a thin but real upper tail.

The bar for the elite is a B

Start with the number that reframes everything else: 82.

Score 82 out of 100 on our assessment — email authentication, TLS and certificates, web security headers, DNS including DNSSEC — and you have outscored 99% of the 376.9 million domains we measured. On the grade scale that the same methodology assigns, 82 is a B.

In almost any other field, the 99th percentile is where excellence lives: the 99th percentile of runners, of exam results, of income. On the internet, the 99th percentile is a domain that does most things right and still leaves gaps.

On the internet, you don’t need to be perfect to be in the top 1%. You need to be a B student.

That fact cuts two ways. For the pessimist: the overall standard is so low that “elite” starts below excellent. For the optimist — and we lean this way — the club is wide open. Nobody is being priced out of the top 1%.

The empty top

Now climb above the 1% line and count who is actually up there. Above the 82-point threshold sit roughly 3.77 million domains — the top percentile of a 376.9-million-domain population, by definition. Here is who holds the top grades within and above that group:

The gap between the percentile and those two counted rows is the story. The 1% club admits B grades because there are nowhere near enough A grades to fill it. If the internet’s top 1% were populated only by A-or-better domains, it would be more than six-sevenths empty.

Fewer than 73,000 domains, out of 377 million measured, get everything close enough to right to earn an A+. For scale: that is a population of top-tier domains smaller than a mid-sized town, guarding the correctness bar for the entire measured web.

We profiled this group before, from the email side, in The Fully Protected Few. What the score-level view adds is the emptiness above the cutoff. There is no dense cluster of near-perfect domains just below A+. The top of the distribution is thin all the way up.

The middle class that isn’t

Every inequality story needs a middle class. The web’s is missing.

The median graded domain — the midpoint of the distribution, with roughly 188 million domains on each side — scores 45 out of 100. Under the grade bands, anything below 60 is an F. The median domain on the internet is a failing domain.

The mean tells a harsher story: 38.34/100. When the mean sits meaningfully below the median, the distribution is pulled down by a concentrated mass at the very bottom — 24.5% of all graded domains score exactly zero. These are domains with no externally visible security configuration whatsoever. The average is not being dragged up by a prosperous tail; it is being dragged down by a dormant one.

And the mass below the midpoint is enormous: 56.9% of all graded domains — 214,351,307 — score below 50/100. Not “below a good score”. Below half marks, on a scale where the passing grade band starts at 60.

More than half the internet scores below 50 out of 100, and most of the half that scores above it still fails.

If you translate the wealth-inequality metaphor honestly, the web looks like a society where the median household is below the poverty line, the 99th percentile is comfortably middle-class, and genuine wealth — the A+ tier — is one household in every 5,220. There is no gated community at the top. There is barely a top.

We mapped the full grade histogram in The Internet Security Grade Curve; this report is the score-level view underneath those grade bands, and the two are consistent: the curve doesn’t slope, it slumps.

The Gini: concentrated poverty, not hoarded wealth

The data forced a conclusion we didn’t expect.

Economists summarise inequality with the Gini coefficient: 0 means everyone has exactly the same, 1 means one party has everything. We computed the Gini coefficient across all 376.9 million security scores.

It is 0.370.

That is a figure in the range of many real-economy income distributions — not extreme inequality, but not the near-equality of a narrowly bunched distribution either. Two structural features drive it. First, scores are bounded between 0 and 100, which mechanically compresses the Gini compared with unbounded quantities like income. Second, the distribution has a very large spike at zero: 24.5% of domains score exactly 0, and most of the rest cluster in the failing range below 60. The upper tail is thin and genuine, not a statistical artefact.

So the wealth-gap framing we walked in with is partly right and mostly wrong. The internet’s problem is not that security is hoarded by an elite while the rest go without. Security is not scarce; the protections involved are overwhelmingly free to switch on. The problem is that nearly nobody switches them on — and a quarter of all domains have switched on nothing whatsoever.

The web’s security problem isn’t inequality of access. It’s near-universal absence of action.

A domain does not need budget to climb this distribution; it needs someone to spend an afternoon in its DNS and server settings. Which makes the 0.370 Gini figure quietly damning: the top grades are free to reach, and 99.85% of the population hasn’t reached an A.

Where the 1% live

The elite may be tiny, but it is not evenly scattered. Group the graded population by top-level domain and the A-or-better rate varies by a factor of nearly fifty between the strongest and weakest of the major TLDs shown here.

Among TLDs with at least 100,000 graded domains, these lead the A-or-better table:

And here is how the web’s largest neighbourhoods compare:

Look closely and the leaders table splits into two distinct cohorts, and both of them matter.

The first cohort is the established European country registries — Denmark, Slovakia, the Netherlands, Switzerland, Norway. These are registries with long-standing security cultures, notably around DNSSEC and email authentication, some backed by registry-level incentives. A Danish domain is roughly nine times more likely to hold an A than a .com.

The second cohort is the one a sceptical reader will spot in ten seconds: .click, .email, .co and .dev — modern gTLDs with no national registry culture at all, sitting shoulder to shoulder with the Scandinavians. What they have instead is platforms. Domains on these endings are disproportionately parked on modern hosting and DNS providers that switch security features on by default: the registrant did not necessarily do anything, the platform did. Far from undermining the point, this second route into the elite proves it. If a hosting default can put a domain in the top fraction of the internet, then the protections concerned demonstrably cost nothing and require no expertise — the two routes to the top are a registry that pushes you there or a platform that carries you there, and neither involves a security budget.

Even so, the best neighbourhood is poor. The single best large TLD on the internet gets 1.39% of its domains to an A. That is the ceiling. In Denmark’s registry — the strongest performer among all large TLDs we measured — more than 98 out of every 100 domains still fall short of an A. Meanwhile .com, which at 141.0 million graded domains is by far the largest slice of the measured web, sits at 0.15%, and the high-volume .xyz manages 0.03% — one A-or-better domain per 3,489 graded.

The best security neighbourhood on the internet still leaves 98.6% of its residents outside the A grades. Where the 1% live turns out to be less like a wealthy district and more like the least-flooded street in a flooded town.

What this means for your business

A score of 45 — the internet’s median — is not an abstract statistic. A domain in the failing mass is typically one whose email can be plausibly forged by a fraudster and whose genuine mail is more likely to be junked, and whose public posture fails the automated checks that larger customers increasingly run before they sign.

So what does the distance from 45 to 82 actually consist of? Not products. The gap between the median domain and the 1% threshold is closed almost entirely within the four check families this report measures: enforcing email authentication rather than merely publishing it, cleaning up TLS and certificate configuration, adding the web security headers that most sites simply never set, and signing DNS. Every one of those is a configuration change in systems the domain owner already pays for.

Because the top 1% starts at 82, and because the checks behind those points are overwhelmingly free configuration rather than paid products, the distance between the median domain and the internet’s elite is measured in settings, not spending. A domain at the median does not need a security budget to reach the 99th percentile. It needs the protections it already has access to switched on and enforced. The barrier is almost never cost; it is that nobody told the owner it mattered.

How we measured it

• Population: 376,928,781 graded domains from the August 2026 census round, figures as of 2026-08-16, scored under methodology v9.
• The score is a weighted sum of externally observable checks — email authentication, TLS and certificates, web security headers, and DNS including DNSSEC. It is a configuration-posture measure. It is not a CVSS score and not a breach-probability estimate; a high score means the externally visible protections are correctly in place, not that a domain cannot be compromised. (Full methodology.)
• The population is the registered web, not the active web. The census grades every domain it can measure, and a large share of any registry is parked, dormant or minimally used. This edition does not publish a live-versus-parked split of the score distribution, so the headline percentiles describe the full registered population; restricting to actively used domains would shrink the failing mass and shift the percentile thresholds. What that restriction cannot change are the absolute counts at the top — 549,635 A-or-better domains and 72,216 A+ domains are all that exist, however the denominator is drawn. We flag this openly as the report’s main limitation; see the FAQ below.
• Grade bands follow the published methodology exactly: A+ ≥95, A ≥90, B ≥80, C ≥70, D ≥60, F below 60.
• Percentiles and the Gini coefficient are computed on the full score distribution of all 376.9 million graded rows. Because scores are bounded (0-100), the Gini value is not directly comparable to income Ginis; we use it to characterise the shape of the distribution. The value of 0.370 reflects a distribution with a large spike at zero (24.5% of domains score exactly 0) and modest spread across the failing range.
• Per-TLD rankings are from the July 2026 census round; August per-TLD breakdowns are in preparation. The global headline figures (median, mean, p99, Gini, grade counts) are from the August 2026 round.
• Correlation, not causation: the association between registry cultures (or platform defaults) and higher A-rates is an observed pattern, not a claimed mechanism.
• Aggregate only. These are population patterns; an individual domain’s grade is shown only to its verified owner.
• Data is stored and processed within the EU.

What this means

For business owners, the median score of 45 is a direct warning. A median-scoring domain is spoofable, likely has no enforcing DMARC policy, and may have inconsistent HTTPS configuration. Larger customers and procurement teams increasingly run automated domain security checks as part of vendor qualification — a 45 fails those checks. The distance from the median to the 99th percentile is a set of free configuration changes, not a product purchase, and most of the journey can be completed in a single afternoon.

For IT managers tasked with improving their organisation’s domain security posture, the 82-point top-1% threshold is a useful and achievable benchmark. It does not require an A. It does not require DNSSEC on every domain or a perfect Content-Security-Policy. It requires enforcing email authentication, maintaining valid TLS, and adding a handful of security headers that most servers can deploy in hours. The fact that this places a domain in the top 1% of the internet says nothing about how easy it is — it says something about how rarely anyone does it.

For security teams building supplier risk programmes, the Gini finding is practically useful: the distribution is concentrated at zero, not spread across a normal curve. A supplier domain that scores above 60 (a passing D grade) is already ahead of the vast majority of the internet. The scoring system rewards incremental progress meaningfully. Using a simple pass/fail cutoff misses the diagnostic value of knowing whether a supplier is at 45 (median, no email authentication) or at 75 (solid C, email authentication in place, gaps in headers and DNSSEC).

Data to cite

• “Entry to the top 1% of 376.9 million graded domains is a score of 82/100 — a B grade — meaning the entire internet’s security elite starts below the A threshold.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “Only 549,635 domains (0.15% of 376.9M graded) score an A or better, and only 72,216 (0.019%) reach A+ — fewer than one in 5,000.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “The median graded domain scores 45/100 — a failing F under methodology v9 — meaning the exact midpoint of the internet is a domain that fails its security assessment.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “56.9% of all graded domains — 214,351,307 — score below 50/100, meaning more than half the web does not reach the halfway mark on a 100-point security scale.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “24.5% of all graded domains score exactly zero — no externally visible security configuration whatsoever — pulling the mean score down to 38.34/100.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “.dk leads all large TLDs with 1.39% of domains at A or better — roughly nine times .com’s rate of 0.15% — reflecting both registry culture and platform defaults.” — defaults.exposed August 2026 Domain Security Census (432M domains)

FAQ

Is a score of 82 really “elite” if it’s only a B?

“Elite” here is strictly relative: 82 is the empirical 99th-percentile score across all 376,928,781 graded domains as of August 2026. The grade bands are absolute standards; the percentile is a ranking. The whole point of this report is the gap between the two — the absolute standard says 82 is a B, and the ranking says 99% of the internet sits below it.

Aren’t most of these just parked or unused domains? Grading empty lots isn’t news.

Partly, yes — and we would rather say so than have you discover it. The measured population is the registered web, and a substantial share of any registry is parked or dormant; unused domains are naturally unconfigured, and they weigh on the median. This edition does not include a live-versus-parked split, so we can’t state exactly where the 1% threshold would land on active domains alone — that is a limitation of this report, and one we intend to close in a future edition. Three things survive the objection regardless. The absolute top counts are denominator-independent: only 549,635 domains anywhere score an A or better, and only 72,216 score A+ — small against any credible estimate of the active web, not just the registered one. The per-TLD contrasts compare like with like: parked domains exist in .dk and .nl too, yet those registries reach A-rates nine times .com’s. And parked domains are not harmless: a registered domain with no enforced email authentication can be used to forge mail whether or not anyone ever built a website on it.

Does a higher Gini coefficient mean internet security is improving?

No — the Gini of 0.370 reflects more spread in the distribution, driven primarily by the large mass of domains scoring exactly 0 (24.5%). The median is 45 and the mean is 38.34; both are failing grades. A wider distribution centred on failure is not an improvement over a tighter one.

Doesn’t a low score just mean your methodology is harsh?

The score is a weighted roll-up of externally observable checks, each of which corresponds to a protection with a documented attack class it mitigates when present — forged email, intercepted traffic, hijacked DNS. A domain scoring 45 is missing real protections, not losing points on a technicality. The score is not, however, a breach-probability estimate, and we don’t present it as one.

Which domains are in the A+ group?

We don’t say, by design. All figures in this report are aggregate; an individual domain’s grade is shown only to its verified owner. What we can characterise is the group’s size — 72,216 domains, 0.019% of the graded web — and where such domains are concentrated, such as the registries and platform-heavy TLDs in the table above.

How do I find out whether my domain is in the failing half or the top 1%?

Check it. The scan is private, free, and shows exactly which checks you pass and how to fix the ones you don’t. Most fixes are free configuration changes.

What changed between July and August 2026?

The global headline figures — median, mean, Gini, grade counts — are from the August 2026 round (asOf 2026-08-16). Per-TLD A-or-better rankings are from the July 2026 round; August per-TLD breakdowns are in preparation. The structural finding — top 1% starts at a B, median is an F — is consistent across rounds.

See where your own domain stands

The median domain scores 45. The top 1% starts at 82. The distance between the two is a set of free settings, and you can find out today which side of the line you’re on.

Check your domain free at defaults.exposed — see your exact score out of 100, which percentile you’re in, and what specific configuration changes would move you from the failing majority toward the top 1%. Takes 30 seconds. No account needed.

The Internet Security Grade Curve →

Aggregate data only. Data stored and processed in the EU.

How to cite this report

Press / blog: defaults.exposed (2026). The Top 1% of the Internet Starts at a B. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/the-top-1-percent-of-the-internet-starts-at-a-b

Academic: defaults.exposed. (2026, August 20). The Top 1% of the Internet Starts at a B. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/the-top-1-percent-of-the-internet-starts-at-a-b

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=376,928,781; median score=45; p99=82)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026