--- title: "Website security score - free benchmark vs 500,000+ sites" description: "Scan any domain for free and score its CSP, security headers and attack resistance out of 100 against the best-configured sites and 500,000+ others." url: "https://centralcsp.com/en/tools/compare/" lang: "en" --- Tools # Compare your site's security Run a live scan and see how your security posture stacks up against the best-configured sites in our dataset and the dataset average. Free, no account needed. ### Compare your site Run a live scan of your site and see how its security posture compares to the best-configured sites in our dataset and the dataset average. Scan & compare Enter a domain and we scan it, then chart its scores against this year's cohort. Any public domain works, including one you do not own. Want the findings behind these scores? [Run the security headers scan](https://centralcsp.com/en/tools/security-headers/) Sample result ## What your benchmark looks like How a typical store that ships the basic headers but no Content Security Policy compares. The green and orange references are the real 2026 dataset values your own scan is charted against. Your site 46/100 Best cohort 71/100 Average 25/100 Your site Best cohort Average ### Security Headers Security Headers | | Your site | Best cohort | Average | | --- | --- | --- | --- | | X-Frame-Options | 100/100 | 100/100 | 100/100 | | X-Content-Type-Options | 100/100 | 100/100 | 40/100 | | Cache-Control | 72/100 | 99/100 | 92/100 | | Strict-Transport-Security | 55/100 | 99/100 | 23/100 | | Referrer-Policy | 20/100 | 100/100 | 24/100 | ### Attack Resistance Attack Resistance | | Your site | Best cohort | Average | | --- | --- | --- | --- | | Clickjacking | 95/100 | 99/100 | 35/100 | | Data Exfiltration | 40/100 | 99/100 | 50/100 | | Script Injection | 12/100 | 83/100 | 3/100 | | Supply Chain | 5/100 | 70/100 | 4/100 | The blue series is illustrative. Best-cohort and average values are the real 2026 dataset references, published in the State of the Web report. Run the scan above to draw your own site's polygon. Guide ## Understanding your security benchmark This benchmark scores your site's public security configuration and plots it against how other sites score, so the number comes with a reference point. It answers the question a lone grade cannot: not "is my site secure?" but "is it better or worse configured than everyone else's?". It runs a live scan and charts the result against the rest of the scanned web. ### What the comparison measures It scores what any outsider can verify about your site: the security headers you send, the Content Security Policy behind them, how you hold up against the attack classes that actually hit production sites, and whether your policies report anywhere. Nothing is installed and no account is needed: if a header is missing from your responses, it is missing for everyone who looks. The controls behind each axis are covered in our [web security guides](https://centralcsp.com/en/docs/web-security). ### How the score is calculated Six areas, each scored from 0 to 100, each read from the same public response: - **Security headers:** every protective response header, judged on the value it carries rather than on being present. - **Content Security Policy:** the policy your server sends, with permissive keywords, broad sources and missing directives weighted by what an attacker would use. - **Attack resistance:** what the configuration would actually stop, across the common client-side attack routes. - **Policy enforcement:** which policies you enforce rather than run in report-only mode, and how tightly each one is configured. - **Reporting-capable policies:** whether the policies you send are wired to report violations rather than failing silently. - **Reporting setup:** whether the endpoints you declare exist, are referenced correctly, and would receive what the browser sends. The overall number averages only the areas your site was evaluated on, which is why a site with no policy at all shows fewer spokes rather than a row of zeros. ### Who you are compared against Your scores are charted against two references: the best cohort, meaning the best-configured sites of the year, and the dataset-wide average. Both come from the CentralCSP dataset, the same one behind our annual [State of the Web report](https://centralcsp.com/en/state-of-the-web/). The 2026 edition covers 761,345 scored domains, with a best cohort of 150 sites. Both references are published and auditable, which is unusual for a benchmark. Security ratings products compare you to an industry cohort they do not disclose; here you can open the report and see how the population scores, control by control. The references refresh with each edition, so the bar moves as the web does. ### How to read your security benchmark radar One look at the radar tells you where you stand: each spoke is a control scored 0 to 100 for your site, the best cohort, and the average, so the controls carrying your gap are visible immediately. Two conventions keep the picture honest: a control that does not apply to you is left off the chart rather than dragging your polygon to zero, while a required control that is missing stays at 0, so a real gap is never hidden. ### If a security ratings platform flagged your site [SecurityScorecard](https://securityscorecard.com), [Bitsight](https://www.bitsight.com) and [RiskRecon](https://www.riskrecon.com) read the same outside-in signals this scan does: your public responses, no agent, no access. Everything they can flag about your headers and client-side policies, this scan flags too, and it keeps going where their checklists stop: value-level findings, attack resistance, and whether your reporting actually works. To see those findings on your own site, control by control, run one of these: [CSP scanner](https://centralcsp.com/en/tools/csp-scanner/), [Security headers checker](https://centralcsp.com/en/tools/security-headers/) or [Reporting API checker](https://centralcsp.com/en/tools/reporting-api/). Each one lists the exact headers and directives behind the score, and what to change. If you are working from a specific finding, two walkthroughs cover the common ones: [fix SecurityScorecard CSP findings](https://centralcsp.com/en/blog/fix-securityscorecard-csp-findings) and [fix BitSight CSP findings](https://centralcsp.com/en/blog/fix-bitsight-csp-findings). BitSight began rating CSP in July 2025: [why BitSight now rates CSP](https://centralcsp.com/en/blog/bitsight-rau25-was-csp). CentralCSP is not affiliated with SecurityScorecard, Bitsight, RiskRecon or any ratings platform, and no tool can promise a specific score: this scan shows you the same outside-in evidence they measure, so you can fix the controls behind it. Keep reading - [Content-Security-Policy overview](https://centralcsp.com/en/docs/web-security/policies/content-security-policy) - [Web security guides](https://centralcsp.com/en/docs/web-security) - [CSP violation reports](https://centralcsp.com/en/docs/web-security/reporting-api/reports/csp-violation) - [Subresource Integrity](https://centralcsp.com/en/docs/web-security/other/subresource-integrity) - [How to improve your security headers grade](https://centralcsp.com/en/blog/improve-security-headers-grade) More free tools ## Keep auditing with the other free tools Every tool is free, runs without an account, and scores with the same severity scale. ### CSP scanner Fetch a URL's live Content-Security-Policy and score it against known bypasses, wildcard sources and missing directives. - Directive-level findings - Shareable results link [Run the CSP scanner](https://centralcsp.com/en/tools/csp-scanner/) ### CSP evaluator Paste a policy that is not deployed yet and get the same scoring and findings as a live scan, no URL required. - Audit before you ship - Same scoring engine [Evaluate a policy in the CSP evaluator](https://centralcsp.com/en/tools/csp-evaluator/) ### Security headers scanner Grade every security header a URL sends, from HSTS to Permissions-Policy, with each finding explained and prioritized. - Every header, one grade - Fix list ordered by impact [Scan your security headers](https://centralcsp.com/en/tools/security-headers/) ### Reporting API checker Check that violation reporting actually works: endpoints, Reporting-Endpoints and Report-To, and which security features really report. - Endpoint and feature mapping - Silent drops flagged [Check your Reporting API setup](https://centralcsp.com/en/tools/reporting-api/) ### SRI hash generator Turn a CDN script or stylesheet URL into its Subresource Integrity hash, with a ready-to-paste tag and a CORS check. - SHA-256, 384 and 512 - CORS verified for you [Generate an SRI hash](https://centralcsp.com/en/tools/sri-hash/) ### CSP hash generator Turn an inline script or style into the hash that lets it run under a strict policy, right in your browser. - Runs entirely client-side - SHA-256, 384 and 512 [Generate a CSP hash](https://centralcsp.com/en/tools/csp-hash/) FAQ ## Frequently asked questions Scoring, the dataset and security ratings, answered. ### How does the website security comparison work? Enter a domain and the tool runs a live scan of the site's public responses, following redirects to the final URL. It scores five areas on a 0-100 scale: security headers, Content Security Policy, attack resistance, reporting-capable policies, and reporting setup. Each area is then charted against two references from the CentralCSP dataset: the best-configured sites of the year and the dataset-wide average. A scan typically finishes in under a minute. ### What is a good website security score? In the 2026 CentralCSP dataset the average site scores 46 out of 100 overall and the best-configured cohort averages 92.4, so "average" is a very low bar. Above 60 overall already puts a site ahead of 93% of the scanned web. The gap is mostly Content Security Policy (dataset average 7 out of 100) and HSTS (average 23), so those two areas usually move a score fastest. ### Can I benchmark a competitor's site? Yes. The scan reads only the public responses a site sends to everyone, the same view any visitor gets, so it runs on any reachable domain whether or not you own it. It handles one domain at a time: scan yours, then scan theirs, and read both polygons against the same two references, the best cohort and the population average. Nothing is logged into, nothing is probed beyond what a browser would request. ### Why a score out of 100 instead of an A to F grade? Because a letter collapses five different areas into one character, and the letter you get tells you nothing about which one is dragging you down. Here each area keeps its own 0-100 spoke, so you can see that your headers are fine and your Content Security Policy is the gap, rather than being handed a C. A grade also has no reference point: it says how you did against a fixed checklist, not where you sit relative to other sites, which is the question this tool exists to answer. ### Which sites is mine compared against? The same dataset behind the CentralCSP State of the Web report: 761,345 scored domains in the 2026 edition. The green reference is the best cohort, the 150 best-configured sites of the year; the orange reference is the dataset-wide average. Both are published in the report, and they refresh with each annual edition. ### How often do the reference numbers change? Once a year. The best cohort and the population average both come from the State of the Web census, which is published annually, and the references your radar is drawn against right now are the 2026 edition. Your own score is live: it is measured at the moment you scan, so re-running after a fix shows the change immediately even though the references stay put until the next edition. ### Is the benchmark free? Do I need an account? Yes, it is free, and no account or email is needed. An invisible captcha runs before each scan to keep automated abuse out. The scan is a real live scan of your site, not a cached lookup, so you can re-run it right after deploying a fix and see the change. ### Will fixing these gaps improve my SecurityScorecard or Bitsight rating? Those platforms observe the same public signals this scan does, so deploying a fix gives their scanners a compliant response to observe, which is what resolves the corresponding finding. Use the platform's own resolve or rescan flow to speed that up. No tool can promise a specific score change: composite ratings weigh your entire digital footprint with proprietary models, and CentralCSP has no access to your scorecard. ### Why does my radar show fewer spokes than expected? Controls that were not evaluated for your site are left off the chart so they do not flatten your polygon at zero. A control that is required but missing is different: it stays on the chart at 0, so a genuine gap remains visible. Your overall score follows the same rule and averages only the areas you were evaluated on. ## Today's score is one deploy from changing CentralCSP watches your CSP and security headers continuously, with reports straight from your visitors' browsers, and alerts you when a deploy drops a header or a new script appears. The posture you benchmarked today is still there next quarter. Add one header, no code changes. [Start with CentralCSP](https://app.centralcsp.com) [See continuous header monitoring](https://centralcsp.com/en/platform/monitoring/) --- Available in: [en](https://centralcsp.com/en/tools/compare/), [fr](https://centralcsp.com/fr/tools/compare/)