58% of Small Websites Have No Web Application Firewall vs 34.4% of the Top 10,000

Within minutes of a website going live, automated bots start knocking. Some try common passwords on the login page, some look for old plugins with known flaws, and some just send enough junk traffic to slow the site down. A large company has a security team watching for this. A small business with a five-page website usually has nobody watching at all.

A web application firewall, or WAF, is a service that sits between a website and its visitors and filters out that traffic before it reaches the site. Many are run by content delivery networks, services that also store copies of a site closer to visitors to make it load faster. For a small site without a developer checking its logs, a firewall is one of the most useful protections available, and a basic version is free.

58% of small websites, those outside the 10 million most visited, have no firewall or similar security layer. Among the 10,000 most visited websites, 34.4% have none. Protection falls steadily at every step down in popularity, so the sites least able to recover from an attack are the least likely to be protected.

We used the public HTTP Archive crawl of September 2026, which records the services each of 15,470,478 website homepages runs behind. We counted homepages served through a service that offers firewall protection, including Cloudflare, Sucuri, Imperva and Akamai, and grouped websites by popularity using Google's Chrome UX Report, treating sites beyond the top 10 million as small sites.

A homepage "has no web application firewall" when it is not served through any firewall-capable service. A broader measure also counts Fastly and Amazon CloudFront, delivery networks that offer security features, as protection. Small websites are the 7,041,424 homepages outside the 10 million most visited, the long tail where most small businesses sit.

Among the 10,000 most visited websites, about two thirds sit behind a firewall-capable service and 34.4% have none. The share without one rises at every step down: 35.2% for sites ranked 10k to 100k, 41% for 100k to one million, 53.6% for one million to 10 million and 58% for small websites beyond that.

Counting Fastly and Amazon CloudFront as protection changes little: 56.2% of small websites still have none. The gap is not about which provider a site picked. Most small sites without a firewall are served straight from their host with nothing in front of them.

Across all 15,470,478 homepages, 54.9% have no web application firewall. In the long tail alone, that is 4,085,333 homepages answering every request directly, including every password guess and every scan for an outdated plugin.

Small websites are the ones that most need a filter. They often run on shared hosting with limited capacity, so a flood of bot traffic can take them offline, and their owners rarely see an attack until the site is defaced or the host suspends it. A firewall stops most of that traffic before it costs the site anything.

Cloudflare sits in front of 6,807,674 website homepages, the large majority of the 6,973,152 homepages served through any firewall-capable service. For small sites, a free Cloudflare plan is often the first and only layer between the site and the open internet.

A site owner behind Cloudflare still has to turn on the right settings for their plan. Bot protection, rate limits on login pages and managed firewall rules each need switching on, and a site that was added years ago may be running with the defaults it started with.

If your website is not behind a content delivery network or firewall service, set one up. A free Cloudflare plan takes under an hour for most sites and adds basic bot protection, protection against traffic floods and HTTPS handling. Sucuri and similar services offer managed firewalls for a monthly fee, with someone else watching the rules.

If you already use Cloudflare or a similar service, log in and check that its security features are switched on: bot protection, rate limiting for login pages and the managed rules your plan includes. Then keep the site behind it updated, since a firewall blocks known attacks but does not fix the flaws they target.

If your site runs on WordPress, our wordpress security services set up and tune firewall protection alongside login protection, malware scanning and backups.

Embed this research

Cite this study