網站安全統計：2026 年 11 月調查

Originally published on Sitecheckly.

95% of surveyed sites were missing Cross-Origin-Opener-Policy, 66% were missing Content-Security-Policy, and 72% had no Organization schema. These findings point to gaps in browser protections and machine-readable business information. Check your own pages, then prioritize changes that fit your content and infrastructure.

These website security statistics come from the November 2026 Sitecheckly survey, which used the Tranco top 10,000, list 7462X. Of the requested domains, 4,934 of 10,000 could be analyzed. The rest were mostly CDN, DNS and API hosts, sites that asked crawlers to stay away in robots.txt, or sites that blocked automated requests.

All survey figures below come from the Sitecheckly open dataset, published under CC BY 4.0. They describe the analyzed home pages, not every page on those sites.

What do the website security statistics show?

Missing security headers were common in the survey. The average security score was 77.1 out of 100, but that average should not replace a review of individual findings.

The CAA check had a different denominator: 78% of the 4,141 sites checked had no CAA records. Keep that distinction when comparing findings. Not every check had the same eligible sample.

Component checks also found potential maintenance risks. In the survey, 13% had at least one detectable component that was end of life or matched a known vulnerability.

That is not a complete inventory of vulnerable software. Only exposed versions of common components were checked, making detection a lower bound. Version matching can also overstate risk when a Linux distribution has backported a fix without changing the visible version number. These limits are explained in the survey methodology.

Review policies before deploying them

A missing header is a configuration finding, not proof that a site has been compromised. Treat the result as a prompt to investigate, not an instruction to copy a policy unchanged.

For implementation details, use the security headers guide. Review which policies suit the page, test changes before deployment, and verify the response afterward.

For a practical starting point:

• Check which headers the page currently returns.
• Review flagged components against their relevant advisories and your installed packages.
• Confirm whether a reported version has received distribution-specific fixes.
• Test policy changes against the page's actual behavior before publishing them.

Run the separate, passive security audit to check the URL you enter. Its findings are a starting point for review, not evidence of a successful attack.

How ready are sites for AI search?

The average AI-search readiness score was 66.4 out of 100. The survey also found that 70% had no concise answer-first paragraphs detected, while 72% had no Organization schema.

These AI search readiness statistics identify content and markup checks worth reviewing. They do not establish that a page will or will not receive an AI citation.

Start with the questions your page actually serves. If a visitor needs a definition, instruction or direct answer, put that answer near the relevant heading. Keep supporting detail below it. Do not force every page into a question-and-answer format just to satisfy a checklist.

Where appropriate, use Organization structured data to describe the business or organization represented by the page. Make sure the information accurately reflects that organization. Adding markup does not guarantee a citation.

Review search crawler access separately from training access

Among the 4,546 sites with a readable robots.txt, 6.2% blocked at least one AI search crawler. This does not mean those sites blocked every AI search engine.

Crawler rules need to match your goals. For OpenAI, OAI-SearchBot is the crawler used for ChatGPT search, while GPTBot is used for model training. ChatGPT-User fetches pages in response to user requests. These are distinct roles, as explained in OpenAI's crawler documentation.

Before changing access rules, decide what you want to allow. A decision about training access is not automatically a decision about search visibility.

Use the AEO audit to review the entered page. If you need context for the checks, read the answer engine optimization explainer. Treat the results as actionable checks, not a promise of placement in AI answers.

Which SEO issues should site owners check?

The survey's website SEO statistics showed several basic page-level gaps:

These findings call for inspection rather than automatic changes.

Review informative images. Write descriptive alternative text that explains the image in the context of the page. Avoid turning it into a list of keywords. Google's image guidance explains how useful alt text helps describe image content.

Check the main heading. If the audit finds no H1, review the page and give its main topic a clear heading. Write it for the visitor, rather than adding a heading solely to clear a warning.

Review the canonical URL where appropriate. Decide which URL should represent the content before changing the declaration. Follow Google's canonicalization guidance, especially when several URLs contain duplicate or similar content.

Run the SEO audit for a focused check, or use the combined SEO and AEO audit to review both areas in one scan. Each run checks the URL entered.

How was the survey conducted, and what are its limits?

The survey used HTTP-only analysis of home pages from the sample described above. It respected robots.txt and reports aggregate findings only. The methodology sets out the scope and detection limits.

Read the results with these limits in mind:

• Home pages are not whole sites. A finding on a home page does not describe every product page, article, form or application route.
• Unanalyzed domains are not passing results. The survey cannot characterize domains that could not be analyzed.
• Different checks can have different denominators. CAA and readable robots.txt findings use the eligible counts stated alongside them.
• Exposed-version detection is incomplete. Component findings are lower bounds, while backported fixes can complicate version-based risk assessment.
• The sample is not every kind of website. Crawlable home pages from a top-site list may not represent smaller sites or other page types.

Use the survey to identify useful questions for your own pages. Do not treat an aggregate percentage as a diagnosis of your website.

How can you turn the findings into a page-level checklist?

Start with a representative URL, such as an important landing page. Keep the scope clear: Sitecheckly checks one page per run, not the whole site.

• Run the free combined SEO and AEO audit. Review content, markup and SEO findings for the URL entered. No sign-up is required.
• Run the separate security audit on the same URL. It is free, requires no sign-up and uses passive checks.
• Sort findings by risk and relevance. Investigate component warnings and choose policies that suit your infrastructure. Do not copy every recommendation just because it appears in the survey.
• Make changes and verify them. Recheck the affected page after deployment and confirm that its intended behavior still works.
• Check other important URLs separately. Repeat the process for pages with different content or functionality. Each URL needs its own run.

Keep a short record of each finding, the decision you made and the verification result. That gives the next person a clear reason for the configuration, rather than another unexplained checklist item.

Frequently asked questions

Does a missing security header prove a site has been compromised?

No. A missing header is a configuration finding, not evidence of a compromise. Assess its relevance and test a suitable policy before deploying it.

Does Organization schema guarantee an AI search citation?

No. Structured data can describe an organization in a machine-readable format, but it does not guarantee a citation.

Can the survey results be generalized to every website?

Not reliably. The survey covers crawlable home pages from a top-site list, so it may not represent smaller sites or other pages.

Does Sitecheckly continuously monitor my site?

No. Each run checks the URL entered. The security audit is separate and passive.

Want to see how your own site does? Run a free audit at sitecheckly.com.

Figures in this article come from Sitecheckly's own audit data; see the methodology.