Piperic
methodology
PricingToplistsBrowse free →

Methodology — The State of Website Security

Everything below describes how the 2026-07-25 edition was produced. Our aim is that any journalist or researcher can judge — and if needed challenge — every number in it. Where we do not know something, this page says so.

1 · What counts as “a website” here

The unit of analysis is a registrable domain, counted once. Not a page, not a hostname, not a URL.

2 · How the pages were fetched

No part of this study attacks, probes or tests any website. We issue exactly one ordinary request per site — the same request your browser makes when you type the address.

ParameterValue
User-AgentPipericBot/1.0 (+https://piperic.com/bot)
Method / targeta single GET of the homepage. HTTPS is attempted first: https://domain, then https://www.domain, and only if both fail http://domain — so “no HTTPS” means HTTPS was tried and did not answer, not merely that an HTTP page was seen
Redirects followedup to 2; the final URL after redirects is the one measured
Also requestedrobots.txt, ai.txt, llms.txt (public policy files)
Never donelogin attempts · password guessing · port scanning · admin-path probing · form submission · authenticated requests · any request a normal visitor would not make

The crawler identifies itself, publishes contact information at piperic.com/bot, honours robots.txt and rate-limits per host. Site owners can have their domain excluded on request.

3 · The window this snapshot describes
Edition2026-07-25
Pages analysed59,648,710 live, content-validated websites
Crawl windowthe 60 days preceding the edition date — the report describes a recently re-crawled cohort, not a one-day census
Archive coverage7,022 of 7,022 archive segments processed, none skipped
Vulnerability dataWordfence Intelligence, downloaded 2026-07-24 — 37,804 vulnerability records across 17,949 components
Analysis run2h 44m, signal extractor v2.0

The snapshot is frozen. Re-running the report on the same snapshot reproduces the same numbers; a later edition will differ because the web moved, not because the method changed.

4 · Hygiene, not hackability

This report measures how well sites are maintained. It does not measure whether a site can be broken into, and it never asserts that any site is exploitable.

Running a component version that appears in a published CVE range is a maintenance fact. Whether that flaw is reachable on a particular site depends on configuration, other software, hosting controls and the flaw itself — none of which we can see, and none of which we tested. Read every vulnerability figure in this report as “this version is documented as flawed”, never as “this site is hackable”.

5 · Denominators, coverage, and the biases we know about
6 · Exact definitions of the headline metrics
MetricExact rule
No HTTPSthe final URL after redirects begins with http://. A site that redirects to HTTPS counts as having HTTPS.
Password over HTTPthe page carries an <input type="password"> and was served without TLS. We additionally resolved where the enclosing form submits (see §7).
No SRIthe page loads at least one cross-origin <script src> and that tag has no integrity attribute. Pages with no external scripts are excluded from the denominator.
Mixed contentan HTTPS page references at least one sub-resource (script, stylesheet, image, font) over http://.
End-of-life platformmarkers unique to a release line whose vendor has publicly announced an end-of-support date that has passed. Announced by the vendor — not our judgement.
Known-vulnerable componenta readable component version falls inside a published affected-version range in the Wordfence Intelligence database.
Exploitable without loginas above, and the CVSS vector of the matched record contains PR:N (“Privileges Required: None”).
7 · Where password fields actually submit

A password box on an unencrypted page does not automatically mean the password travels unencrypted — the form could still post to an https:// address. We measured it rather than assuming either way.

Form destinationShareResult
Relative or empty action75.4%resolves back to the same unencrypted page — plain text
Explicit http://13.5%plain text
Protocol-relative //host/…0.1%inherits the page scheme — plain text
No form element5.8%submitted by JavaScript — undetermined, counted neither way
Explicit https://5.1%submission encrypted; the page itself can still be rewritten in transit, because it arrived unprotected

Measured on a sample of 11,743 such pages (7,439,296 live pages scanned), by resolving each enclosing form's action the way a browser would.

8 · Compromise indicators, and how far we audited them

Each detector was hand-audited before publication. We state what we checked, not a precision guarantee: these sample sizes bound the error loosely, not tightly.

IndicatorManual auditWhat it detects
Hidden remote-code implant0 false positives in 30obfuscated payload that decodes to a remote-execution channel — the decoded behaviour is required, not the obfuscation alone
Injected hidden link spam1 false positive in 25a visually hidden block with ≥2 links to unrelated external domains, spam-signalled, on a site whose own subject is unrelated
PHP / database error0 in 25a server-side error string in the visible page text, with script blocks removed
Server path exposure0 in 25a real server filesystem path, e.g. /var/www/…
Defacement0 in 8 unambiguous casesdefacement text in the title, H1 or head
SQL error disclosure69% — failed removed from this edition. The audit found it was matching raw PHP source served unparsed — a real and arguably worse finding, but a different one. It returns when it is measured properly.

Our rule: below 85% on this audit, a detector is not published. The row above is what that rule looks like when it costs us a headline.

9 · What we never publish
10 · Reproducibility and data
11 · Corrections

Material corrections to a published edition are listed here with their date, permanently. Nothing is silently edited.

2026-07-27 — Two corrections before first distribution. (a) The defacement ratio between platforms was stated as 46×; recomputed from raw counts rather than rounded per-100k rates it is 45.5×, and it is a prevalence ratio measured at one moment, not an incidence rate. (b) A section describing a single large implant campaign originally framed the affected sites as compromised victims. A profile of the carrying sites did not support that reading; the section was rewritten and moved out of the compromise chapter.