Everything below describes how the 2026-07-25 edition was produced. Our aim is that any journalist or researcher can judge — and if needed challenge — every number in it. Where we do not know something, this page says so.
The unit of analysis is a registrable domain, counted once. Not a page, not a hostname, not a URL.
No part of this study attacks, probes or tests any website. We issue exactly one ordinary request per site — the same request your browser makes when you type the address.
| Parameter | Value |
|---|---|
| User-Agent | PipericBot/1.0 (+https://piperic.com/bot) |
| Method / target | a single GET of the homepage. HTTPS is attempted first: https://domain, then https://www.domain, and only if both fail http://domain — so “no HTTPS” means HTTPS was tried and did not answer, not merely that an HTTP page was seen |
| Redirects followed | up to 2; the final URL after redirects is the one measured |
| Also requested | robots.txt, ai.txt, llms.txt (public policy files) |
| Never done | login attempts · password guessing · port scanning · admin-path probing · form submission · authenticated requests · any request a normal visitor would not make |
The crawler identifies itself, publishes contact information at
piperic.com/bot, honours robots.txt and rate-limits per host.
Site owners can have their domain excluded on request.
| Edition | 2026-07-25 |
|---|---|
| Pages analysed | 59,648,710 live, content-validated websites |
| Crawl window | the 60 days preceding the edition date — the report describes a recently re-crawled cohort, not a one-day census |
| Archive coverage | 7,022 of 7,022 archive segments processed, none skipped |
| Vulnerability data | Wordfence Intelligence, downloaded 2026-07-24 — 37,804 vulnerability records across 17,949 components |
| Analysis run | 2h 44m, signal extractor v2.0 |
The snapshot is frozen. Re-running the report on the same snapshot reproduces the same numbers; a later edition will differ because the web moved, not because the method changed.
This report measures how well sites are maintained. It does not measure whether a site can be broken into, and it never asserts that any site is exploitable.
Running a component version that appears in a published CVE range is a maintenance fact. Whether that flaw is reachable on a particular site depends on configuration, other software, hosting controls and the flaw itself — none of which we can see, and none of which we tested. Read every vulnerability figure in this report as “this version is documented as flawed”, never as “this site is hackable”.
.com — by structured country evidence in the page itself. Roughly three quarters of generic-domain
sites carry no such evidence and are counted in no country at all. National counts are therefore floors.| Metric | Exact rule |
|---|---|
| No HTTPS | the final URL after redirects begins with http://. A site that
redirects to HTTPS counts as having HTTPS. |
| Password over HTTP | the page carries an <input type="password"> and was
served without TLS. We additionally resolved where the enclosing form submits (see §7). |
| No SRI | the page loads at least one cross-origin <script src> and that tag
has no integrity attribute. Pages with no external scripts are excluded from the denominator. |
| Mixed content | an HTTPS page references at least one sub-resource (script, stylesheet, image, font)
over http://. |
| End-of-life platform | markers unique to a release line whose vendor has publicly announced an end-of-support date that has passed. Announced by the vendor — not our judgement. |
| Known-vulnerable component | a readable component version falls inside a published affected-version range in the Wordfence Intelligence database. |
| Exploitable without login | as above, and the CVSS vector of the matched record contains
PR:N (“Privileges Required: None”). |
A password box on an unencrypted page does not automatically mean the password travels
unencrypted — the form could still post to an https:// address. We measured it rather than assuming
either way.
| Form destination | Share | Result |
|---|---|---|
Relative or empty action | 75.4% | resolves back to the same unencrypted page — plain text |
Explicit http:// | 13.5% | plain text |
Protocol-relative //host/… | 0.1% | inherits the page scheme — plain text |
| No form element | 5.8% | submitted by JavaScript — undetermined, counted neither way |
Explicit https:// | 5.1% | submission encrypted; the page itself can still be rewritten in transit, because it arrived unprotected |
Measured on a sample of 11,743 such pages (7,439,296 live pages
scanned), by resolving each enclosing form's action the way a browser would.
Each detector was hand-audited before publication. We state what we checked, not a precision guarantee: these sample sizes bound the error loosely, not tightly.
| Indicator | Manual audit | What it detects |
|---|---|---|
| Hidden remote-code implant | 0 false positives in 30 | obfuscated payload that decodes to a remote-execution channel — the decoded behaviour is required, not the obfuscation alone |
| Injected hidden link spam | 1 false positive in 25 | a visually hidden block with ≥2 links to unrelated external domains, spam-signalled, on a site whose own subject is unrelated |
| PHP / database error | 0 in 25 | a server-side error string in the visible page text, with script blocks removed |
| Server path exposure | 0 in 25 | a real server filesystem path, e.g. /var/www/… |
| Defacement | 0 in 8 unambiguous cases | defacement text in the title, H1 or head |
| SQL error disclosure | 69% — failed | removed from this edition. The audit found it was matching raw PHP source served unparsed — a real and arguably worse finding, but a different one. It returns when it is measured properly. |
Our rule: below 85% on this audit, a detector is not published. The row above is what that rule looks like when it costs us a headline.
/security-report/data.json; each country
edition exposes its own at /security-report/<cc>/data.json. These are the exact inputs the pages
render from.
Material corrections to a published edition are listed here with their date, permanently. Nothing is silently
edited.
2026-07-27 — Two corrections before first distribution. (a) The defacement ratio between platforms
was stated as 46×; recomputed from raw counts rather than rounded per-100k rates it is 45.5×, and it is a
prevalence ratio measured at one moment, not an incidence rate. (b) A section describing a single
large implant campaign originally framed the affected sites as compromised victims. A profile of the carrying
sites did not support that reading; the section was rewritten and moved out of the compromise chapter.