REAL DATA · UPDATED CONTINUOUSLY
What 136 Production Sites Revealed
The research population contains 136 distinct authorized production websites across 167 eligible scans, with 778 findings from a catalog whose currently enabled Deep Scan runs up to 702 configured checks after current ownership proof. Public aggregates use completed, authorization-gated and coverage-eligible observations from the currently activated scoring methodology. Rows without an exact matching methodology are excluded. No site is identified by name.
THE EXPOSURE GAP
What Hackers Can See
NO CSP HEADER
Content-Security-Policy was absent in a completed CSP scan
n=133
NO DNSSEC
DNSSEC was absent in a completed DNS scan
n=122
NO DMARC
No DMARC record was observed in a completed DNS scan
n=122
ADOPTION OF BASIC SECURITY
What is Actually Working
HAS CSP HEADER
n=133
METHODOLOGY
How These Numbers Were Computed
Scan corpus: 136 distinct authorized production websites across 167 eligible scans. One row per deployment domain is selected by highest authorization trust tier, then freshness, so rescans do not inflate percentages.
Measurement method: Exposure percentages use conclusive scanner observations and show a per-metric denominator. Unknown, blocked, timed-out, cached, demo, opted-out, insufficient-coverage, and methodology-mismatched observations are excluded. Each published percentage requires at least 30 observed sites.
Threat telemetry: Live numbers come from UNPWNED's own honeypot system, exposed at /api/public/threat-stats. Sessions require linked non-health event evidence in the 30-day rolling window. Health-only and unverifiable sessions are excluded. The metric describes suspicious probing, not confirmed compromise or exploitation. Source IPs are not published.
License: All aggregated statistics on this page are released under CC BY 4.0. Free to cite with attribution to UNPWNED.
See where your site sits
Run the same 149 checks on your own domain. Free, no signup required.