STATUS IS UPWEBSITE READINESS
Owner workspace
Explore SIU

Category benchmark · Snapshot 23 October 2026

Passwords & Cybersecurity: website readiness

31 configuration checks across 46 Passwords & Cybersecurity sites from the SID website catalog, with 14 individual profiles for sites in the Chrome UX Report top 50K.

Sites measured
46

all popularity bands

Median readiness index
76/100

all sites: 64

Profiles
14

top-50K sites

Weakest lane
Recover

lowest weighted score

Readiness by lane

Enable

82/100

All sites 77

Harden

69/100

All sites 56

Accelerate

64/100

All sites 64

Recover

2/100

All sites 10

Biggest gaps for Passwords & Cybersecurity sites

The checks with the most room to improve, weighted by impact.

  1. No render-blocking scripts in <head>

    37% observed · all sites 48%

    Add defer to scripts that need the DOM, async to independent ones such as analytics, or move them to the end of the body.

    Guide: Control Third-Party Scripts Before They Control Your Page

  2. security.txt published

    29% observed · all sites 7.1%

    Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.

    Guide: A Practical Website Health Check for Owners

  3. HTTP/3 advertised

    33% observed · all sites 37%

    Turn on HTTP/3 at your CDN. Browsers fall back to HTTP/2 automatically, so the risk is low.

    Guide: CDN Guide for Website Owners

  4. Modern image formats in use

    55% observed · all sites 40%

    Serve WebP or AVIF with a JPEG or PNG fallback, either through an image CDN or by generating both formats at build time.

    Guide: AVIF, WebP, JPEG, and PNG: Choose the Right Image Format

  5. Static files cached for 30 days or more

    58% observed · all sites 51%

    Give versioned (fingerprinted) CSS, JavaScript, fonts and images Cache-Control: public, max-age=31536000, immutable, and change the file name whenever the content changes.

    Guide: Browser Caching Guide for Website Owners

  6. DNSSEC signed

    24% observed · all sites 8%

    Enable DNSSEC at your DNS provider, then add the DS record at your registrar. Plan provider moves carefully: a stale DS record can make the domain fail to resolve.

    Guide: Website Uptime Readiness: Prepare Before Traffic Arrives

Where Passwords & Cybersecurity sites lead

  • HSTS kept for at least a year67% observedall sites 34%
  • CAA records limit who can issue certificates44% observedall sites 13%
  • Content Security Policy present59% observedall sites 32%
  • DMARC policy enforces quarantine or reject65% observedall sites 39%

Stack mix

CDN and edge

Platform or framework

DNS operator

Certificate authority

Readiness leaders

Passwords & Cybersecurity sites in the top 50K with the highest share of observed practices (at least 26 of 31 checks measured). This lists only what we observed on 23 October 2026; owners can request a correction.

  1. haveibeenpwned.com94/100
  2. proton.me90/100
  3. malwarebytes.com88/100
  4. adsblocks.com87/100
  5. hcaptcha.com81/100
  6. safety.google80/100
  7. totaladblock.com79/100
  8. virustotal.com76/100
  9. lastpass.com75/100
  10. totalav.com73/100

All 31 checks for Passwords & Cybersecurity

CheckLaneObservedAll sitesMeasured
HTTP requests move to HTTPSHarden90%91%41
HSTS kept for at least a yearHarden67%34%46
TLS 1.3 negotiatedHarden91%91%46
Certificate has more than 14 days leftHarden96%99%46
Certificate lifetime of 100 days or lessHarden61%67%46
CAA records limit who can issue certificatesHarden44%13%45
DNSSEC signedHarden24%8%46
security.txt publishedHarden29%7.1%45
DMARC policy enforces quarantine or rejectHarden65%39%46
X-Content-Type-Options: nosniffHarden65%48%46
Framing restrictedHarden67%51%46
Content Security Policy presentHarden59%32%46
Referrer-Policy setHarden46%24%46
HTTP/2 negotiatedAccelerate89%90%46
HTTP/3 advertisedAccelerate33%37%46
HTML compressedAccelerate89%93%46
Static files cached for 30 days or moreAccelerate58%51%38
Modern image formats in useAccelerate55%40%38
Offscreen images lazy-loadedAccelerate54%62%37
No render-blocking scripts in <head>Accelerate37%48%46
robots.txt publishedEnable87%76%45
XML sitemap discoverableEnable78%70%46
Reachable over IPv6Enable43%48%46
Canonical URL declaredEnable70%68%46
Meta description writtenEnable96%84%46
Mobile viewport configuredEnable96%94%46
Structured data presentEnable59%51%46
Social preview image setEnable76%57%46
Page language declaredEnable96%90%46
At most one redirect to the homepageEnable93%98%46
Nameservers spread across providersRecover2.2%10%46

Passwords & Cybersecurity profiles

Readiness index shown next to each site.