Original research
Website security benchmarks.
What small and mid sized businesses actually run in production, measured live from public infrastructure rather than surveyed.
Dataset still building
We publish a percentage only once at least 30 websites have been measured, because anything smaller is noise dressed up as a finding. We are at 2 so far. Every site that runs a free AI audit adds one anonymous measurement.
How this was measured
- Every figure comes from a live check of public infrastructure: DNS records, email authentication policy, HTTP response headers, and domain registration data. Nothing here is surveyed, estimated, or modelled.
- The sample is self selected. These are businesses that chose to run our free audit, so it is not a random sample of all companies and should not be read as one.
- Measurements are stored without the domain, business name, or any text the visitor typed. The rows are anonymous when written, not anonymised afterwards, so no figure here can be traced back to a business.
- Percentages are published only above 30 measurements, and each section states the number of sites it is based on.
- Absence of a signal is not proof of absence. A site behind strict bot protection may not respond to an automated request, and those rows are excluded rather than counted as failures.
Free to cite with attribution to JarvisBitz Tech and a link to this page.
Run the same checks on your own site.
The free AI audit measures these signals live and explains what each one means for your business.