Our free Surface Check has been run on 281 domains, and the encouraging headline is that most are in reasonable shape on the outside: a third score an A and another third a B. The genuinely serious problems, a certificate close to expiry, a domain with no DMARC at all, a site still served over plain HTTP, are rare. What is common is a set of quiet, low-severity hardening gaps that almost every team has at least one of, and that each take minutes to fix.
Before the numbers, a word on what this is and what it is not. As of August 2026, these figures come only from the 281 domains checked with our free Surface Check. This is not a representative study of every startup, and there are no domains or identities behind the numbers: they are anonymous aggregates of grades and findings. Read it as a snapshot of the domains checked with our free tool, not a survey of the whole market.
How the grades broke down
Every check ends in a single letter grade, from A to F (here is how the Surface Score is worked out), based on what a domain exposes to the public internet. Across the 281 domains, the spread was:
- A, 33%. The important public protections are in place, with little left for an opportunist to grab onto.
- B, 36%. Solid, with a short list of easy wins left. This was the most common grade.
- C, 22%. Several protections missing or misconfigured. Nothing exotic, just gaps that make a team an easier target than it needs to be.
- D, 7%. The basics are largely absent.
- F, 1%. Very little in place on the public surface.
The encouraging read is that most of these domains are in reasonable shape on the outside. The less comfortable read is that the distance between a B and an A is usually a short list of missing headers and email settings, and almost everyone has at least one of them. A grade is a snapshot of the external surface only. It is not a verdict on the whole product, and, as we cover below, a strong grade can still sit over real internal gaps.
The gaps we saw, most serious first
Here are the findings from the 281 checks, ordered by how much each one actually matters rather than by how often it appears, with the straightforward fix for each.
Missing browser security headers. This is where most of the meaningful hardening sits. A Content-Security-Policy is absent on 55% and X-Content-Type-Options: nosniff on 46%. On 38% the site can be loaded inside a hostile frame, which is the basis of clickjacking, 20% send no HSTS, so a first visit can be quietly downgraded to plain HTTP, and 62% set no Referrer-Policy. These headers tell the browser how to protect your users, and most are a few lines of configuration. Our free security headers checker lists exactly which ones you are missing and what to set them to.
Email that can be spoofed or intercepted. Email authentication was mostly healthy: only 3% had no SPF record and 6% had no DMARC record at all, though 15% run DMARC in monitor-only mode, which watches but does not stop spoofed mail. Separately, 90% publish no MTA-STS policy, so a message to their domain can be delivered without TLS if an attacker interferes with the connection. MTA-STS is the single most common finding in the whole sample, but it is also a low-severity one, so it is worth keeping in proportion. The fixes are to move DMARC to an enforcing setting once you have checked your legitimate senders, and to publish an MTA-STS policy. You can confirm your records with our free SPF checker and DMARC checker.
Software versions on display (21%). One in five domains advertise their software and version number in HTTP response headers. On its own this is low risk, but it hands an attacker a shortcut: they can match your version straight to a list of known issues. Turning off version banners is usually a single configuration change.
Cookies without the Secure flag (14%). Around one in seven set cookies without the Secure flag, so those cookies can be sent over an unencrypted connection. Setting the flag is a one-line change in most frameworks and closes an easy interception route.
No way to report a problem (65%). Nearly two thirds of the domains publish no security.txt file, so a researcher who spots something has no obvious, trusted way to tell you. It is low severity, but the fix is a short file at /.well-known/security.txt listing a contact address, and it removes an awkward guessing game at exactly the wrong moment.
What this means for you
The pattern across all 281 checks is consistent: the external basics are cheap to fix and quick to verify, yet the same few gaps keep slipping through. If you do nothing else, add the missing security headers, move DMARC to an enforcing policy, and then publish an MTA-STS policy and a security.txt. That handful of changes would move a large share of these domains up a grade.
It is worth being just as clear about the limits. A passive external check cannot see inside your application, so a good grade is a good sign, not a clean bill of health. It will not catch a secret left in your code or config, or the internal access-control and data-handling issues that a list of surface findings will never reach. As we have written before, a list of vulnerabilities is not security: the value is in working through the findings and fixing them, not in collecting them.
Check your own surface
You can see where you sit against these numbers in about thirty seconds. Run a free Surface Check to get your own grade and a plain list of what to fix, then use the SPF, DMARC, and security headers checkers to confirm each change as you make it.
If you want a review that goes beyond the surface, into the access control, data handling, and configuration an external check cannot reach, our application security assessment is built for startups and fast-moving teams. We find and fix, prepare the remediation, and hand it to your team to deploy. And if a paid review finds nothing beyond what the free Surface Check already showed you, we refund the review fee. You can get in touch through our website.