--- title: "Web Application Firewall Statistics: 58% of Small Sites" url: https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall description: "Web application firewall statistics: 58% of small websites have no firewall or similar security layer, against 34.4% of the top 10,000 sites. See the data." lang: en --- Share Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fsmall-business-web-application-firewall&text=58%25%20of%20Small%20Websites%20Have%20No%20Web%20Application%20Firewall%20vs%2034.4%25%20of%20the%20Top%2010%2C000 Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fsmall-business-web-application-firewall Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fsmall-business-web-application-firewall Share on Reddit: https://www.reddit.com/submit?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fsmall-business-web-application-firewall&title=58%25%20of%20Small%20Websites%20Have%20No%20Web%20Application%20Firewall%20vs%2034.4%25%20of%20the%20Top%2010%2C000 **58%** of websites outside the 10 million most visited, the long tail where most small businesses sit, have no web application firewall or similar security layer in front of them. Among the 10,000 most visited websites, 34.4% have none. Analysis of 15,470,478 homepages, including 7,041,424 outside the top 10 million · the public HTTP Archive crawl, September 2026 ## Key Findings 1. 1. **58%** of small websites, those outside the 10 million most visited, have no web application firewall or similar security layer in front of them. Copy stat 2. 2. Among the 10,000 most visited websites, **34.4%** have no web application firewall, so about two in three are protected against 42% of small websites. Copy stat 3. 3. Across all 15,470,478 website homepages, **54.9%** have no web application firewall or similar security layer. Copy stat 4. 4. Cloudflare sits in front of **6,807,674** website homepages, the large majority of the 6,973,152 homepages with any firewall-capable service. Copy stat 5. 5. **4,085,333** small website homepages have no firewall-capable service at all. Copy stat ## Summary Within minutes of a website going live, automated bots start knocking. Some try common passwords on the login page, some look for old plugins with known flaws, and some just send enough junk traffic to slow the site down. A large company has a security team watching for this. A small business with a five-page website usually has nobody watching at all. A web application firewall, or WAF, is a service that sits between a website and its visitors and filters out that traffic before it reaches the site. Many are run by content delivery networks, services that also store copies of a site closer to visitors to make it load faster. For a small site without a developer checking its logs, a firewall is one of the most useful protections available, and a basic version is free. **58%** of small websites, those outside the 10 million most visited, have no firewall or similar security layer. Among the 10,000 most visited websites, 34.4% have none. Protection falls steadily at every step down in popularity, so the sites least able to recover from an attack are the least likely to be protected. ## What we measured We used the public HTTP Archive crawl of September 2026, which records the services each of 15,470,478 website homepages runs behind. We counted homepages served through a service that offers firewall protection, including Cloudflare, Sucuri, Imperva and Akamai, and grouped websites by popularity using Google's Chrome UX Report, treating sites beyond the top 10 million as small sites. A homepage "has no web application firewall" when it is not served through any firewall-capable service. A broader measure also counts Fastly and Amazon CloudFront, delivery networks that offer security features, as protection. Small websites are the 7,041,424 homepages outside the 10 million most visited, the long tail where most small businesses sit. ## Firewall protection falls steadily with website size 58% of small websites have no web application firewall or similar security layer. Among the 10,000 most visited websites, about two thirds sit behind a firewall-capable service and 34.4% have none. The share without one rises at every step down: 35.2% for sites ranked 10k to 100k, 41% for 100k to one million, 53.6% for one million to 10 million and 58% for small websites beyond that. Homepages with no web application firewall by website popularity Top 10,000 34.4% 10k to 100k 35.2% 100k to 1 million 41% 1 million to 10 million 53.6% Beyond the top 10 million 58% All websites 54.9% Source: Suff Digital analysis of 15,470,478 homepages, including 7,041,424 outside the top 10 million · the public HTTP Archive crawl, September 2026 Counting Fastly and Amazon CloudFront as protection changes little: 56.2% of small websites still have none. The gap is not about which provider a site picked. Most small sites without a firewall are served straight from their host with nothing in front of them. ## Four million small websites face attacks with no filter in front Across all 15,470,478 homepages, 54.9% have no web application firewall. In the long tail alone, that is 4,085,333 homepages answering every request directly, including every password guess and every scan for an outdated plugin. Small websites are the ones that most need a filter. They often run on shared hosting with limited capacity, so a flood of bot traffic can take them offline, and their owners rarely see an attack until the site is defaced or the host suspends it. A firewall stops most of that traffic before it costs the site anything. ## Cloudflare provides most firewall coverage on the web Cloudflare sits in front of 6,807,674 website homepages, the large majority of the 6,973,152 homepages served through any firewall-capable service. For small sites, a free Cloudflare plan is often the first and only layer between the site and the open internet. A site owner behind Cloudflare still has to turn on the right settings for their plan. Bot protection, rate limits on login pages and managed firewall rules each need switching on, and a site that was added years ago may be running with the defaults it started with. ## What this means for small business owners If your website is not behind a content delivery network or firewall service, set one up. A free Cloudflare plan takes under an hour for most sites and adds basic bot protection, protection against traffic floods and HTTPS handling. Sucuri and similar services offer managed firewalls for a monthly fee, with someone else watching the rules. If you already use Cloudflare or a similar service, log in and check that its security features are switched on: bot protection, rate limiting for login pages and the managed rules your plan includes. Then keep the site behind it updated, since a firewall blocks known attacks but does not fix the flaws they target. If your site runs on WordPress, our wordpress security services (https://www.suffdigital.com/services/website-maintenance/wordpress-security-malware-removal) set up and tune firewall protection alongside login protection, malware scanning and backups. ## Embed this research Paste this on your site to embed the charts. It links back to the source automatically.

Source: 58% of Small Websites Have No Web Application Firewall vs 34.4% of the Top 10,000 - Suff Digital

## Cite this study APA Suff Digital. (2026). 58% of Small Websites Have No Web Application Firewall vs 34.4% of the Top 10,000. https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall Plain link 58% of Small Websites Have No Web Application Firewall vs 34.4% of the Top 10,000 - Suff Digital - https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall ## Frequently asked questions ### What share of small business websites have a firewall? ### Do popular websites use web application firewalls? ### How many websites have no web application firewall? ### Is Cloudflare a web application firewall? ## Related studies - Website Maintenance 61.6% of Websites Skip HSTS, the Security Header That Forces Secure Connections: https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing - Website Maintenance 8.4% of Popular WordPress Sites Run a Plugin That Is Abandoned or Pulled for Security: https://www.suffdigital.com/resources/data-studies/abandoned-wordpress-plugins - Website Maintenance Nearly 3 in 10 Websites Load a JavaScript Library With a Known Security Flaw: https://www.suffdigital.com/resources/data-studies/vulnerable-javascript-libraries - Website Maintenance 83% of PrestaShop Websites Showing a jQuery Version Run One With Known Flaws vs 36.1% Web-Wide: https://www.suffdigital.com/resources/data-studies/outdated-jquery-websites ## Structured data ```json [ { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://www.suffdigital.com/#organization", "name": "Suff Digital", "alternateName": "Suff Digital Marketing", "url": "https://www.suffdigital.com/", "logo": { "@type": "ImageObject", "@id": "https://www.suffdigital.com/#logo", "url": "https://www.suffdigital.com/logo.png", "contentUrl": "https://www.suffdigital.com/logo.png", "caption": "Suff Digital" }, "image": { "@id": "https://www.suffdigital.com/#logo" }, "description": "Suff Digital is a full-stack digital marketing agency that turns websites into predictable revenue engines, SEO, paid media, content, CRO, and web design built around revenue, not vanity metrics.", "slogan": "Digital marketing built for what's next.", "email": "hello@suffdigital.com", "telephone": "+1-629-236-0099", "foundingDate": "2022", "founder": { "@type": "Person", "name": "Matt Suffoletto", "jobTitle": "Founder & CEO" }, "contactPoint": [ { "@type": "ContactPoint", "telephone": "+1-629-236-0099", "email": "hello@suffdigital.com", "contactType": "sales", "areaServed": "US", "availableLanguage": [ "en" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Nashville", "addressRegion": "TN", "postalCode": "37219", "addressCountry": "US" }, "areaServed": { "@type": "Country", "name": "United States" }, "sameAs": [ "https://www.linkedin.com/company/suff-digital/", "https://www.instagram.com/suffdigital/", "https://www.youtube.com/@suffdigitalmarketing", "https://www.tiktok.com/@suffdigital" ], "knowsAbout": [ "Search Engine Optimization", "Pay-Per-Click Advertising", "Paid Social Advertising", "Conversion Rate Optimization", "Web Design", "Digital PR", "Link Building", "Website Migration", "Website Maintenance and Support", "Technical SEO", "Local SEO", "AI Search Optimization" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Suff Digital Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Search Engine Optimization (SEO)", "url": "https://www.suffdigital.com/" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Pay-Per-Click (PPC) Advertising", "url": "https://www.suffdigital.com/services/ppc" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Paid Social Advertising", "url": "https://www.suffdigital.com/services/paid-social" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Conversion Rate Optimization (CRO)", "url": "https://www.suffdigital.com/services/cro" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Web Design", "url": "https://www.suffdigital.com/services/web-design" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Digital PR & Link Building", "url": "https://www.suffdigital.com/services/digital-pr" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Website Migration", "url": "https://www.suffdigital.com/services/website-migration" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Website Maintenance & Support", "url": "https://www.suffdigital.com/services/website-maintenance" } } ] } }, { "@type": "WebSite", "@id": "https://www.suffdigital.com/#website", "url": "https://www.suffdigital.com/", "name": "Suff Digital", "inLanguage": "en-US", "publisher": { "@id": "https://www.suffdigital.com/#organization" } } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "Article", "@id": "https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall#article", "headline": "58% of Small Websites Have No Web Application Firewall vs 34.4% of the Top 10,000", "description": "58% of websites outside the 10 million most visited, the long tail where most small businesses sit, have no web application firewall or similar security layer in front of them. Among the 10,000 most visited websites, 34.4% have none.", "image": [ "https://www.suffdigital.com/images/suff-digital-share-16x9.jpg" ], "url": "https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall", "datePublished": "2026-09-24", "dateModified": "2026-09-24", "author": { "@type": "Person", "name": "Matt Suffoletto", "jobTitle": "Founder & CEO", "url": "https://www.suffdigital.com/who-we-are" }, "publisher": { "@id": "https://www.suffdigital.com/#organization" }, "mainEntityOfPage": { "@id": "https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall", "@type": "WebPage" }, "isPartOf": { "@id": "https://www.suffdigital.com/#website" } }, { "@type": "BreadcrumbList", "@id": "https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://www.suffdigital.com/" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://www.suffdigital.com/resources" }, { "@type": "ListItem", "position": 3, "name": "Data Studies", "item": "https://www.suffdigital.com/resources/data-studies" }, { "@type": "ListItem", "position": 4, "name": "58% of Small Websites Have No Web Application Firewall vs 34.4% of the Top 10,000" } ] }, { "@type": "Dataset", "@id": "https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall#dataset", "name": "58% of Small Websites Have No Web Application Firewall vs 34.4% of the Top 10,000", "description": "58% of websites outside the 10 million most visited, the long tail where most small businesses sit, have no web application firewall or similar security layer in front of them. Among the 10,000 most visited websites, 34.4% have none.", "url": "https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall", "creator": { "@id": "https://www.suffdigital.com/#organization" }, "datePublished": "2026-09-24", "dateModified": "2026-09-24", "license": "https://creativecommons.org/licenses/by/4.0/", "isAccessibleForFree": true, "measurementTechnique": "The public HTTP Archive crawl; Google's Chrome UX Report popularity ranking" }, { "@type": "FAQPage", "@id": "https://www.suffdigital.com/resources/data-studies/small-business-web-application-firewall#faq", "mainEntity": [ { "@type": "Question", "name": "What share of small business websites have a firewall?", "acceptedAnswer": { "@type": "Answer", "text": "About 42%. 58% of small websites, those outside the 10 million most visited, have no web application firewall or similar security layer." } }, { "@type": "Question", "name": "Do popular websites use web application firewalls?", "acceptedAnswer": { "@type": "Answer", "text": "Mostly. 34.4% of the 10,000 most visited websites have no web application firewall, against 58% of small websites." } }, { "@type": "Question", "name": "How many websites have no web application firewall?", "acceptedAnswer": { "@type": "Answer", "text": "54.9% of 15,470,478 website homepages have no web application firewall, including 4,085,333 small website homepages." } }, { "@type": "Question", "name": "Is Cloudflare a web application firewall?", "acceptedAnswer": { "@type": "Answer", "text": "Cloudflare offers web application firewall features and sits in front of 6,807,674 website homepages, more than any other firewall-capable service." } } ] } ] } ] ```