UNPWNED / First-party observations / October 2026
Your site is live. Did the security basics ship with it?
We analyzed eligible UNPWNED scans from submitted domains between 3 May and 8 October 2026. On 463 of 700 checked homepages, no CSP was detected. The figures below are observations from completed checks, not confirmed exploits.
Activity and research windows
Completed CSP checks
700
One latest eligible scan per domain between 3 May and 8 October 2026. This is the CSP field denominator; each other signal has its own completed-check denominator.
First retained scan
Mar 2026
Operational scan records extend from 2 March through 8 October 2026. They include repeat and test activity and are separate from the research observations.
01 / What the scanner observed
Three gaps worth checking
These are different checks and their domains can overlap. The figures are not a vulnerability severity ranking. Scan profiles and scanner methods changed during the observation window.
01 / Observed signal
No CSP detected on the checked page
Completed CSP checks
Why it matters
A well-configured Content Security Policy can limit the impact of injected scripts. No policy detected on the checked page is a missing layer of defense, not proof that an XSS flaw exists.
What to check next
Inspect the policy your pages actually deliver, including any HTML meta policy, and test a suitable policy before enforcing it.
02 / Observed signal
Three or more security headers missing on the checked response
Completed response-header checks
Why it matters
Response headers help browsers enforce protections around framing, transport and content handling. The risk depends on which headers are missing from the checked response and what other protections exist.
What to check next
Review each missing header against your application and deploy the relevant controls without breaking intended behavior.
03 / Observed signal
No DMARC record detected on domains with MX
Completed DNS checks on domains with a non-null MX record
Why it matters
DMARC can tell receiving mail systems how to handle messages that fail domain alignment. A missing record may weaken spoofing defenses, but it does not prove a domain is spoofable.
What to check next
If you send mail from the domain, verify SPF and DKIM alignment, then introduce an appropriate DMARC policy.
02 / From observation to action
A finding is useful when you know what to do next
See the signal
UNPWNED reports what its completed external checks observed, with severity and coverage context.
Work through a fix
Eligible paid reports after domain verification add technical detail, fix instructions and prompts you can bring into your coding workflow.
Verify the result
Run another authorized check and compare only observations backed by comparable coverage.
Make the next check yours
Find out what is visible on your own site.
Run a limited free public check of your site. An account shows finding titles and severity for completed checks. Owner-authorized checks require domain verification.
03 / How to read this research
Method and limits
What was counted
The latest research-eligible scan per domain from 3 May through 8 October 2026 UTC. Test, cached, opted-out, unauthorized and coverage-gapped records were excluded by the research rules and a fresh opt-out check. Authorization-limited scans could contribute conclusive presence fields, but not score claims. Each published count also requires a successful scanner run and a recorded field value.
What it cannot establish
These submitted domains are a self-selected sample, not a measure of all websites. Domain keys do not necessarily represent separate businesses. Scan profiles and methods changed during the window, so these signals are not a time trend, a confirmed exploit count or a comparison of AI development tools.
Snapshot checked on 12 October 2026. The earlier September report used a shorter, closed observation window and a different cohort selection. Its figures should not be added to these counts.
UNPWNED retains the aggregate query and full reproduction notes internally. Public figures contain no customer or domain identifiers, raw scan output, credentials or individual findings.
Spot a measurement issue? Contact us so we can review and correct it.
Research analysis by UNPWNED. Text and layout prepared with AI assistance.